'Can environment variables in React be accessed from the client?
I know it's bad practice to have environment variables containing backend API keys on the client side (React). How insecure is this practice? These keys are injected during compile time on the client. Is it relatively easy to access these keys? Would someone be able access these keys via developer tools from client given that they know the environment variable names?
Solution 1:[1]
Yes. You should never store API keys in react env. You can read how it is read and stored in build from here React Docs
WARNING: Do not store any secrets (such as private API keys) in your React app!
Environment variables are embedded into the build, meaning anyone can view them by inspecting your app's files.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | Nishant Chorge |