# Hiding API keys

**URL:** <https://forum.freecodecamp.org/t/hiding-api-keys/78564>\
**Category:** General\
**Created:** [January 20, 2017, 3:19am UTC](https://forum.freecodecamp.org/t/hiding-api-keys/78564 "2017-01-20T03:19:21Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![JohnnyBizzel](https://sea3.discourse-cdn.com/freecodecamp/user_avatar/forum.freecodecamp.org/johnnybizzel/32/37661_2.png) [@JohnnyBizzel](https://forum.freecodecamp.org/u/JohnnyBizzel)\
**Post date:** [January 20, 2017, 3:19am UTC](https://forum.freecodecamp.org/t/hiding-api-keys/78564/1 "2017-01-20T03:19:21Z")

</div>

I know how to do this for Node and Heroku but how about an ordinary bit of Javascript hosted on my own hosting.  
Or even codepen?

---

<div class="post-metadata">

**Author:** ![PortableStick](https://sea3.discourse-cdn.com/freecodecamp/user_avatar/forum.freecodecamp.org/portablestick/32/65591_2.png) [@PortableStick](https://forum.freecodecamp.org/u/PortableStick)\
**Post date:** [January 20, 2017, 6:30am UTC](https://forum.freecodecamp.org/t/hiding-api-keys/78564/2 "2017-01-20T06:30:24Z")

</div>

Unfortunately, there’s no way of hiding code that gets run in the browser.

---

<div class="post-metadata">

**Author:** ![Neotriz](https://sea3.discourse-cdn.com/freecodecamp/user_avatar/forum.freecodecamp.org/neotriz/32/22474_2.png) [@Neotriz](https://forum.freecodecamp.org/u/Neotriz)\
**Post date:** [January 20, 2017, 6:53am UTC](https://forum.freecodecamp.org/t/hiding-api-keys/78564/3 "2017-01-20T06:53:45Z")

</div>

Unfortunately, you cannot hide on the client side.

However, what you can do is set an AJAX request to get the API key from your server. I believe this is the only way to hide API keys on the client-side.

---

<div class="post-metadata">

**Author:** ![PJ-Coding](https://sea3.discourse-cdn.com/freecodecamp/user_avatar/forum.freecodecamp.org/pj-coding/32/15908_2.png) [@PJ-Coding](https://forum.freecodecamp.org/u/PJ-Coding)\
**Post date:** [January 20, 2017, 8:22am UTC](https://forum.freecodecamp.org/t/hiding-api-keys/78564/4 "2017-01-20T08:22:43Z")

</div>

Hi,

if you are working on the weather app, there is not really a good way to hide the key. It is a known problem. When you want to use a weather api, use one where nothing happens when you publish the key. For example …after xxxx calls the api is not working anymore. for this day/week/month. .There are some apis where you must pay after xxxx calls automatically, you should not use them for codepen… of course!

---

<div class="post-metadata">

**Author:** ![JohnnyBizzel](https://sea3.discourse-cdn.com/freecodecamp/user_avatar/forum.freecodecamp.org/johnnybizzel/32/37661_2.png) [@JohnnyBizzel](https://forum.freecodecamp.org/u/JohnnyBizzel)\
**Post date:** [January 20, 2017, 12:03pm UTC](https://forum.freecodecamp.org/t/hiding-api-keys/78564/5 "2017-01-20T12:03:54Z")

</div>

Yes, I was thinking hiding them in a database is what most systems will do.  
I don’t expect too much traffic so I’ll not worry about if for now. 😊

---

<div class="post-metadata">

**Author:** ![ILM](https://sea3.discourse-cdn.com/freecodecamp/user_avatar/forum.freecodecamp.org/ilm/32/363239_2.png) [@ILM](https://forum.freecodecamp.org/u/ILM)\
**Post date:** [January 16, 2021, 5:10pm UTC](https://forum.freecodecamp.org/t/hiding-api-keys/78564/6 "2021-01-16T17:10:41Z")

</div>

Closed on January 16, 2021, 5:10pm UTC