i'm working on an electron js app & i need to connect it to an API knowing that the source code of an electron-js app is visible it's a huge security risk to leave the API key there ! how can i solve this problem ?

CodePudding user response：

Instead of having the electron app (whether from the page or from the main process) make a request to the API directly, you can have it make a request to your own server instead - then, your server can make the request to the API, so that the key is only visible to your server, and isn't exposed publicly anywhere.

This will also let you gate requests from clients - if, for example, the credentials a client sends don't match what you need, or if they make too many requests in too short a time, you can cut them off.

CodePudding user response：

You can't. If API key is shared, it's probably designed to be used in the backend.

The solution for that is to create a backend API for proxying API calls. Such proxying API should utilize authentication, so each user must send individual credentials.