Why we picked it This clears up a mistake that leaks data straight out of Airtable and similar tools: putting a private key in front-end code where anyone can read it. It explains the public-versus-private key distinction and why a private key must sit behind a backend proxy that the browser calls instead. Read it before you connect any service that hands you one all-powerful key.
API Key Security for No-Code Apps: Public Keys, Private Keys, and Backend Proxies
From WeWeb by WeWeb
- Only public keys belong in front-end code
- A private key in the browser grants full read and write access
- Route private keys through a backend proxy the browser calls