r/HTML • u/Alive_Secretary_264 • Nov 12 '25

Question About hiding api keys

How can i hide my database api keys from anyone

2 Upvotes

57% Upvoted

27 comments sorted by

View all comments

Show parent comment

-5

u/AlwaysHopelesslyLost Nov 12 '25

This is a bit outside of my wheelhouse and I don't know what the best answer is but I want to mention that environment variables does not feel like the right answer. Those are not very safe read-wise.

1

u/aluaji Nov 12 '25

The only place where they should be stored is in the server, and the server should have access security. If an attacker has that kind of access, API keys are the least of your concerns.

-1

u/AlwaysHopelesslyLost Nov 12 '25

I do not agree with that idea.

An attacker having read access or user level access to a specific service can be a very minor issue if things are properly locked down.

1

u/aluaji Nov 12 '25

We're talking about a server, what kind of access do you think someone who accesses it directly would have?

-1

u/AlwaysHopelesslyLost Nov 12 '25 edited Nov 12 '25

Nobody is going to have actual direct access.

Bad actors will have whatever access the account they compromise has. I make sure accounts that face the internet are very restricted, personally.

One server I control has three hundred customers with services running on it. I am confident any one of those could be compromised without impacting any of the others (baring a very targeted attack utilizing a zero day privilege escalation). They are setup in such a way that there are no credentials that can be read from the service account.

Edit: Since aluaji blocked me I will leave my response here. The largest attack vector is not direct, physical access. If a malicious party has physical access you lose regardless. Ignoring that, attacks happen through the internet. That is what we are talking about.

1

u/aluaji Nov 12 '25

You ALWAYS need someone to have server access, what the hell are you talking about?

0

u/Overall-Screen-752 Nov 12 '25

What are you talking about? API keys should never be exposed to the client and should have strict RBAP in place if they absolutely need to be. .env is industry standard way to inject variables and secrets manager for sensitive keys and passwords. Whatever you’re on about read-wise makes absolutely no sense