How do I keep secret keys out of my app?
Don’t ship them. Put a server between your app and the provider that holds the key and adds it to each call, and give your app something safe to send instead.
That server is the part nobody wants to build and run. Here’s why, and the easy way to solve it.
Skip to the one-command wayHiding the key means a server. Running that server is the work.
Anything you ship to a browser or phone can be read, so the key has to live on a server instead. Here is that server, and every part it needs:
Your app
No key inside
The server you now runcall sent
Store the key encrypted
Not in a config file that anyone with access to the server, or the repo, can read.
Check who is calling
Otherwise anyone can use your server to spend your key, which is the leak all over again.
Limit each caller
So a copied app, or a script, can’t run up your bill.
Allow only your own websites
The right CORS rules, so other sites can’t read the responses in a browser.
Add the key to the right calls only
Every call to your provider, and never anywhere else.
Keep it online, patched and fast
It now sits in front of every call your app makes. If it’s down, your app is down.
Your provider
Gets the key
So the key ships in the app, and one browser tab is all it takes
Open a web app, press F12 and look at the Network tab. Every key the frontend sends is right there, and so is anything bundled into its code.
Request URL
https://api.provider.com/v1/forecast?city=rome
Request headers
- Authorization:
- Bearer sk_live_51Hx9QeLd2…f8Kz
- Content-Type:
- application/json
Anyone who opens this tab can copy your key and use it as you.
Get the key out of your app with one command
APIblaze is that server, already built and running. Point it at the API your app calls today:
Put APIblaze in front of the API your app calls
$ npx apiblaze@latest create --target https://api.example.comPaste it in a terminal. No sign-up, no servers. Swap in the API your app calls today, then hand APIblaze its key, as shown below.
APIblaze is an API proxy: every request passes through it first
It sits between your app and the provider. Your app calls APIblaze, and APIblaze calls the provider with your key, which never leaves its side.
Callers
- Your web app, Ana signed inasks to get directions
- A script with a copied client keyasks to make 1,000 calls a minute
- Someone with no key at allasks to call your provider
APIblaze
The API proxy
Checks who is calling and applies your limits, then adds your stored provider key to the call.
Your API
Only sees the calls APIblaze lets through.
Never reached your code.
That’s why it’s the right place for the key. It already sits between your app and your provider, so it can hold the key, add it to each call and remove what your app sent. Here is one call, step by step:
Your app
browser or phone
Authorization: Ana’s sign-in
APIblaze
holds your key
Authorization: Bearer sk_live_••••
The provider
payments, maps, AI…
200 OK
The provider sees a normal call with your key. Your app never had it.
Your key out of your app, step by step
- 1
Hand over the key once
Save it in APIblaze from your terminal or the dashboard. It’s stored encrypted, and APIblaze adds it to every call it sends to your provider.
From your terminal
Put the key in an environment variable, so it stays out of your shell history
$ export PROVIDER_AUTH="Bearer sk_live_…"Save it in APIblaze, encrypted. It is added to every call to your provider
$ npx apiblaze@latest transform set-header myapi Authorization --value-env PROVIDER_AUTH --secret
Replace myapi with your project’s name. Run it again with a new key to rotate it.
Or in the dashboard, under Transformations
The dashboard can also put the key in a query parameter or the request body, for providers that want it there.
- 2
Give your app something safe to send
Your app still sends a credential: a user’s sign-in, or a client key made to be shipped. Here is what someone gets if they copy it, compared with copying your provider key.
If someone copies it Your provider key An APIblaze client key Works against your provider directly Yes, as you No, only through your APIblaze address How much they can spend As much as your account allows 10 requests a second, 3,000 a day by default What it reaches Everything your account can Only your APIs behind APIblaze, under your rules Which websites can use it Any Browsers only let your own sites read the responses Stopping it Rotate the key and ship a new app version Freeze it from the dashboard - 3
Allow only your own website
Browsers then refuse to hand other websites the responses. Scripts ignore that, which is what the rate limit is for.
$ npx apiblaze@latest tenant cors --tenant YOUR_TENANT --origins https://app.example.com
Common questions
About your key
- Where is my key kept?
- Encrypted with AES-256-GCM and tied to this one API, so it cannot be decrypted for any other. APIblaze decrypts it only to add it to a call.
- Can anyone read it back?
- Not from the dashboard or the CLI: once saved, it shows as hidden. A team member can include secrets in a migration export, and that export is logged.
- How do I rotate or remove it?
- Run the same command with the new key and it replaces the old one.
transform remove myapi Authorizationtakes it off. - Does it end up in request logs?
- No. Request logs never record credential headers such as Authorization.
- My provider wants the key in an x-api-key header. Does that work?
- Not yet. APIblaze removes X-API-Key headers before calling another server, so use Authorization or another header your provider accepts.
About your app
- What is an API proxy?
- A service that sits between your app and the API it calls. Every request goes through it first, so it can check the caller and add your key on the way. APIblaze is an API proxy.
- What does my app send instead?
- A user’s sign-in, or a client key: an APIblaze key that is safe to ship in a browser, app or widget.
- What stops someone abusing the client key?
- Every caller is rate-limited, 10 requests a second and 3,000 a day by default, and you can change both. If a key is abused, freeze it from the dashboard.
- Can I limit which websites call it?
- Yes, with a CORS allow-list on your tenant. Browsers then refuse to hand other websites the responses; scripts ignore CORS, which is what the rate limit is for.
- Does this work for mobile apps too?
- Yes. Anything that ships to a device can be unpacked, so the same rule applies: the app gets a client key or a sign-in, never your provider key.
Prices are on the pricing page.
Get your keys out of your app today
One command, no sign-up. Your provider key stays encrypted with APIblaze.
$ npx apiblaze@latest create --target https://api.example.com