I am build a website in Angular which communicates over my REST API on my backend server.
I have managed to auto-generate the code (TypeScript) for my client and now I need it to be available on deployment.
There are several ways to do this and the, in my oppinion, easiest way would be to just publish the client to https://npmjs.org/ and then let everything be installed on deployment from there. Business as usual.
The question is:
Is this a good idea?
Obviously, there's nothing that really can happen, because every client needs a client id and password in order to get dealt with by my server.
But: With this I am simply exposing all endpoints to my backend.
Wouldn't I do a favor to anybody who want to sniff my API? Surely, there must be ways to get that information another way but at least not that easy.
Are my concerns legitimate or basically nonsense?