2

So the thing is, by using React I see no way not to expose my API KEY. Is there any best practices on how to store it? Is it dangerous if someone will inspect my code and find this API key? How people solving this problem?

Improve this question

2 Answers 2

Reset to default
1

Is it dangerous if someone will inspect my code and find this API key? How people solving this problem?

There is no way around this problem and your API keys will always leak.

If you want to mitigate the issue you can create your special server that proxies requests to Alchemy and then manually control IP bans and such.

Improve this answer
4
  • 1
    yeah i though of proxy, thought maybe there is a better way
    – Paul
    Jun 29 at 7:58
  • Yes, it is trivial ,because any one can check the API key from Web developer tools directly in Networks tab. There is no point to obfuscate.
    – Mikko Ohtamaa
    Jun 29 at 11:14
  • 1
    Almost all RPC API providers have a Domain restrictions, just set Domain(s) in the admin panel (Alchemy, Infura … etc) and you will not need to hide your KEY.
    – Archi
    Jun 29 at 18:32
  • Note that domain restriction does not help much, as the most of the API key abuse is server-side and server-side clients can set the domain to any value they wish.
    – Mikko Ohtamaa
    Jun 30 at 7:25
-1

make a .env file and store in it, never push your env file to any git repo or anywhere

Improve this answer
1
  • this is not an answer, that's not how env works in browser. env will be hidden in nodejs env only
    – Paul
    Jun 29 at 7:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.