You’re right, that is a dilemma. I’ll try to answer point-by-point.
I collect the CC data on the frontend and pass it to a Node application which sends it to our 3rd party service. ... However I am being told that passing the data from one application to another is against compliance,
It’s not so much passing data that’s non-compliment (after all, you need to pass it to the 3rd party) as passing it through your server that’s the problem. I like to describe PCI levels in terms of what would need to be compromised in order to steal card data. If the answer is “my webserver” or “my application”, they you’re under SAQ-D, the most onerous. If the answer is “my communication channels with a trusted third party”, then you are probably A or A-EP, like most ecommerce.
This is required because the API key/secret should not be exposed to the client for obvious security reasons. ... from the browser which would mean each person using the app would have the API key/secret being sent to their local machine and if known someone could easily use this to access our payment instruments.
This isn’t as obvious as you’d think. What can someone actually do with these credentials? If all they can be used for is to give you money, they’re not really that sensitive. If they can be used to refund it, they’re critically sensitive. If they can be used to retrieve information that isn’t the PAN, that’s important but not as bad.
This is a big reason why the API credentials are almost certainly not what you log into their portal with. You may also have a different set for non-payment operations.
In the end, you should talk to your payment provider. You’re not the first person to have these issues, and they may already have guidance on how to handle it. (If you are the first... run!)
Many payment systems I’ve seen ask the server to make some kind of setup call, using secret credentials, which then returns a one-time-use value (url, transaction key, etc) to be delivered to the client. Others just restrict what you can do with those creds so they’re safe to expose to the user.
It’s also possible you’re using the wrong API/endpoint. You might be using one intended for in-person payments, and there’s a different one for ecommerce. I’ve seen that too (and made that mistake myself).
