You simply do not send the secret to the frontend. In my case, we use Java Spring Boot as a backend to our React applications. For external APIs to which we need authentication, these requests go frontend -> backend -> external and back. The authentication is only added in the backend. Example: A user is logged in to our dashboard and wants to request callcenter statistics (from external API). The frontend will then call /api/callcenter with the users auth cookie as normal. This contains no auth for the external API. The backend validates user access and requests this data from the external API. The authentication for the external API is now read from the backend environment (or Hashicorp Vault in our case). A request is made to the external API whose response is then returned to the frontend. The user gets the data without ever bedding access to the authentication. Of course this is with a completely standalone backend but similar concepts apply with e.g. NextJS: authentication secrets are simply backend/server only and all frameworks will allow you to safeguard these. An example with OAuth for for example Spotify will be more complicated since these secrets are dynamic but for such a case I'd consider JWTE (encrypted client secrets, best if you already use JWT anyway) or storing these safely in a database. More on reddit.com

A key to access protected resources from a server More on reddit.com

Hey u/Delicious-Setting403 ! If this is a screenshot of a ChatGPT conversation, please reply with the conversation link or prompt. If this is a DALL-E 3 image post, please reply with the prompt used to make this image. Much appreciated! Consider joining our public discord server where you'll find: Free ChatGPT bots Open Assistant bot (Open-source model) AI image generator bots Perplexity AI bot GPT-4 bot (now with vision!) And the newest additions: Adobe Firefly bot, and Eleven Labs voice cloning bot! Check out our Hackathon : Google x FlowGPT Prompt event! 🤖 Note: For any ChatGPT-related concerns, email [email protected] I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns. More on reddit.com

If I create an application which uses a service that requires an api key, do I as a developer request a key, and every request to the service goes through a proxy server? Generally speaking, yes. This "proxy" is just part of your own backend server code, essentially. The client doesn't even necessarily need to know which third-party APIs your backend is using behind the scenes. There might be cases where you don't mind exposing your API key for the third-party service, and can include it in your frontend / application code, which then calls the API directly. It depends on what exactly the API is doing. Often this isn't desirable, for example if you need to enforce your own security rules on top of the API, or you want to limit how often your users can interact with it to avoid racking up large fees for use of the third-party API. More on reddit.com