How do we secure API Key when the application is deployed in public domain for everyone's use?

Vara_PrasadM_S — Tue, 11 Apr 2023 04:21:45 GMT

Hi All,

I would request information on how do we secure API Key. Our app should be working on public domain, I understand we cannot set referrers in our case.

Any suggestions would be very helpful.

Thanks in advance!

With Regards,

Vara Prasad

Re: How do we secure API Key when the application is deployed in public domain for everyone's use?

BryanMc — Tue, 11 Apr 2023 15:07:48 GMT

You could setup a small proxy to handle the API key for the requests. This will hide the key (although without a referrer anyone could still access).

Esri does have sample code for a proxy, but the code is retired now as they recommend one of the following approaches (from esri github page for proxy) although some still rely on having a referrer:

Enable CORS on the non-CORS enabled web server.
Use API keys to use services and access private content.
Configure your security settings in ArcGIS Online or ArcGIS Enterprise.
Access secure services using ArcGIS Online to store your username/password credentials

topic How do we secure API Key when the application is deployed in public domain for everyone's use? in ArcGIS JavaScript Maps SDK Questions

How do we secure API Key when the application is deployed in public domain for everyone's use?

Re: How do we secure API Key when the application is deployed in public domain for everyone's use?