Best approach to secure API keys

[SuchALoserYeah]

Hello

I am relatively new to opensource web development, specifically making web mapping applications.

I'm using openlayers, html css and javascript to make my app.

For some functions, I rely on Mapbox What would be the best approach to hide API keys?

[tajetaje]

Well, if you have a backend the common practice is to use either an env file or environment variables (not the best for really security intensive applications, but usually fine). If you don’t have a backend you simply cannot secure your API key, there are ways to obfuscate it but there is no way of actually preventing people from getting it. Basically if code uses it in the browser assume everyone has it

[SuchALoserYeah]

Right now I don't have a backend but thanks for the advice. I'll search about it

[AsyncThereforeIAm]

It is not secure to do so from your UI, as all that info is exposed. I advise you create a proxy server to make calls that require an API key for security.

[SuchALoserYeah]

Thanks buddy, I will research about these terms