How do I keep secret keys out of my app?
Anything you ship to a browser or phone can be read. APIblaze keeps your keys and adds them to each call instead.
Your app calls its APIblaze address with a user’s sign-in or a key that is safe to ship. Your provider’s key stays encrypted on our side.
Put APIblaze in front of the API your app calls
$ npx apiblaze@latest create --target https://api.example.comPaste it in a terminal. No sign-up, no servers. Swap in the API your app calls today, then hand APIblaze its key, as shown below.
One browser tab is all it takes
Open a web app, press F12 and look at the Network tab. Every key the frontend sends is right there, and so is anything bundled into its code.
Request URL
https://api.provider.com/v1/forecast?city=rome
Request headers
- Authorization:
- Bearer sk_live_51Hx9QeLd2…f8Kz
- Content-Type:
- application/json
Anyone who opens this tab can copy your key and use it as you.
Your app never holds the key
Your app talks to APIblaze. APIblaze talks to your provider, with your key.
Your app
browser or phone
Authorization: Ana’s sign-in
APIblaze
holds your key
Authorization: Bearer sk_live_••••
The provider
payments, maps, AI…
200 OK
The provider sees a normal call with your key. Your app never had it.
Hand over the key once
Save it in APIblaze once, from your terminal or the dashboard. It is stored encrypted, and APIblaze adds it to every call it sends to your provider.
From your terminal
Put the key in an environment variable, so it stays out of your shell history
$ export PROVIDER_AUTH="Bearer sk_live_…"Save it in APIblaze, encrypted. It is added to every call to your provider
$ npx apiblaze@latest transform set-header myapi Authorization --value-env PROVIDER_AUTH --secret
Replace myapi with your project’s name. Run it again with a new key to rotate it.
Or in the dashboard, under Transformations
The dashboard can also put the key in a query parameter or the request body, for providers that want it there.
Your app gets a key that’s safe to ship
Your app still sends a credential: a user’s sign-in, or a client key made to be shipped. Here is what someone gets if they copy it, compared with copying your provider key.
| If someone copies it | Your provider key | An APIblaze client key |
|---|---|---|
| Works against your provider directly | Yes, as you | No, only through your APIblaze address |
| How much they can spend | As much as your account allows | 10 requests a second, 3,000 a day by default |
| What it reaches | Everything your account can | Only your APIs behind APIblaze, under your rules |
| Which websites can use it | Any | Browsers only let your own sites read the responses |
| Stopping it | Rotate the key and ship a new app version | Freeze it from the dashboard |
Allow only your own website to call it:
$ npx apiblaze@latest tenant cors --tenant YOUR_TENANT --origins https://app.example.comCommon questions
About your key
- Where is my key kept?
- Encrypted with AES-256-GCM and tied to this one API, so it cannot be decrypted for any other. APIblaze decrypts it only to add it to a call.
- Can anyone read it back?
- Not from the dashboard or the CLI: once saved, it shows as hidden. A team member can include secrets in a migration export, and that export is logged.
- How do I rotate or remove it?
- Run the same command with the new key and it replaces the old one.
transform remove myapi Authorizationtakes it off. - Does it end up in request logs?
- No. Request logs never record credential headers such as Authorization.
- My provider wants the key in an x-api-key header. Does that work?
- Not yet. APIblaze removes X-API-Key headers before calling another server, so use Authorization or another header your provider accepts.
About your app
- What does my app send instead?
- A user’s sign-in, or a client key: an APIblaze key that is safe to ship in a browser, app or widget.
- What stops someone abusing the client key?
- Every caller is rate-limited, 10 requests a second and 3,000 a day by default, and you can change both. If a key is abused, freeze it from the dashboard.
- Can I limit which websites call it?
- Yes, with a CORS allow-list on your tenant. Browsers then refuse to hand other websites the responses; scripts ignore CORS, which is what the rate limit is for.
- Does this work for mobile apps too?
- Yes. Anything that ships to a device can be unpacked, so the same rule applies: the app gets a client key or a sign-in, never your provider key.
Prices are on the pricing page.
Get your keys out of your app
No sign-up, no servers. Your provider key stays encrypted with APIblaze, and your app never sees it.
$ npx apiblaze@latest create --target https://api.example.com