I am trying to figure out the best way to do this. I have done some searching and all I have found is about storing API keys in a back end, nothing like my use-case where there is no back end.
I am writing a web app which only runs client side, no back end. In essence the app is a visualizer for the responses from a 3rd party API. Each user would provide their own API key and the app would make the API calls on their behalf, then visualize the responses client side.
There is no logging in by the user into anything. The site is an SPA in React which runs totally client side. The only calls the app makes to the wider net is to this 3rd party API (not counting calls to CDNs for resources when the app is first loaded).
How do I store the API key for the user? I also asked this on r/webdev and the answer I got was in plain text in localStorage which does not feel like a good idea.
Since the keys are not leaving the client except when making API calls which are HTTPS I would assume the only way to get the keys would be via an XSS attack?