API keys not private with Camera Kit for Web, is that okay?

Max

Hi!

When hosting a lens with Camera Kit web on my website, it'd be easy for others to figure out my 'private' API keys using the browser's Inspect tool.
Is there something I should do to prevent this, or is it not an issue?

Thanks!

Refract_Studio

Ideally you want to be using environment variables. Often times you can set these up with your host. Many popular hosts have key management features or services.

https://www.smashingmagazine.com/2023/05/safest-way-hide-api-keys-react/

Michael Mase

Hi @Max! Thanks for your post! Currently, we're monitoring internally for abuse of these public tokens but have plans to introduce measures so that tokes can only be used on specified trusted domains. Stay tuned for updates on this!

Max

Thank you! That's good to know :)