Heads up! We're sunsetting this forum to streamline our community space.

join us on Discord for support, updates, and all things Snap AR! See you there!

Sign up for our live Camera Kit office hour on July 17 @ 9:30am (PT) / 4:30pm (GMT)

API keys not private with Camera Kit for Web, is that okay?

Max Posts: 26 🔥

January 28 in General #1

Hi!

When hosting a lens with Camera Kit web on my website, it'd be easy for others to figure out my 'private' API keys using the browser's Inspect tool.
Is there something I should do to prevent this, or is it not an issue?

Thanks!

1

Best Answers

• 

  Refract_Studio Posts: 18 🔥

  January 29 #2 Answer ✓

  Ideally you want to be using environment variables. Often times you can set these up with your host. Many popular hosts have key management features or services.

  https://www.smashingmagazine.com/2023/05/safest-way-hide-api-keys-react/

  1
• 

  Michael Mase Posts: 66 🔥🔥

  January 30 #3 Answer ✓

  Hi @Max! Thanks for your post! Currently, we're monitoring internally for abuse of these public tokens but have plans to introduce measures so that tokes can only be used on specified trusted domains. Stay tuned for updates on this!

  0

Answers

• 

  Max Posts: 26 🔥

  January 29 edited January 30 #4

  Thank you! That's good to know :)

  1