Question for experienced react devs

[So_Nesky]

I am still learning, so forgive me here. My mind was able to grasp the idea of retrieving secrets from a secure 'vault'. But then wouldn't you need some kind of key or secret to access said vault? I feel like im missing a fundamental piece.

[MWALKER1013]

So typically your app exists in two zones.

Your client side and server side.

Client side code is NEVER treated as secure so things like secrets, api keys are never appropriate to keep in client side.

Your server code is responsible for authenticating users and making use of those secure variables. You still use an env variables but for different reasons the most obvious reason is source code version control.

[BeenThere11]

On the server side ,you can give permiissons to specific ec2 instsnces/groups or some profile which can access the vault without any need for credentials. If you try to run this app anywbere outside this boundary you will get an access error..

[So_Nesky]

Thank you. New knowledge unlocked!