3

So the thing is, by using React I see no way not to expose my API KEY. Is there any best practices on how to store it? Is it dangerous if someone will inspect my code and find this API key? How people solving this problem?

Improve this question

1 Answer 1

Reset to default
2

Is it dangerous if someone will inspect my code and find this API key? How people solving this problem?

There is no way around this problem and your API keys will always leak.

If you want to mitigate the issue you can create your special server that proxies requests to Alchemy and then manually control IP bans and such.

Improve this answer
4
  • 1
    yeah i though of proxy, thought maybe there is a better way
    – Paul
    Commented Jun 29, 2022 at 7:58
  • Yes, it is trivial ,because any one can check the API key from Web developer tools directly in Networks tab. There is no point to obfuscate.
    – Mikko Ohtamaa
    Commented Jun 29, 2022 at 11:14
  • 1
    Almost all RPC API providers have a Domain restrictions, just set Domain(s) in the admin panel (Alchemy, Infura … etc) and you will not need to hide your KEY.
    – Archi
    Commented Jun 29, 2022 at 18:32
  • Note that domain restriction does not help much, as the most of the API key abuse is server-side and server-side clients can set the domain to any value they wish.
    – Mikko Ohtamaa
    Commented Jun 30, 2022 at 7:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.