I've been searching and searching for what seems days and have not come up with any definitive answer on a solution to my problem.

To explain without going into terrible detail I am building a store, this store does NOT have a cart system, so the user will purchase one item at a time, possibly with a quantity system but that's beside the point, it will also NOT have a login or registration system for users.

In the accepting payments department we are relying on Stripe with some PHP and ajax so handle that end, we have used the before over SSL with great success and I am confident in it's security abilities.

When things get a little fuzzy is when I hook into my backend sever that is serving me json objets referencing products. When a user makes a purchase we will obviously want to remove that many from the quantity of that item in the database. For the time being during my proof of concept portion of this build I have been using Parse and a great Parse Adapter that someone built for Ember.js. It is working great and I can get the items and edit the quantity of them as well. The problem is that it requires that I place a few API keys that could potentially allow people to inspect the javascript, grab those keys and use them to make other REST requests to the server backend.

I haven't done a terrible amount of research in how secure Parse's backend is but it seems seemingly simple to grab those keys and use them like I mentioned above.

For reference here is the Adapter that I am using that will maybe give you a better idea of how it's working.


I'm really hoping someone can shed some light on this subject because I am at the end of my rope it seems here, I just can't seem to wrap my head around this.

1 Answer 1


Ultimately, you should not expose API keys to the client, if those API keys can be used to make authorized transactions against the REST API that the client would not otherwise be allowed to make. Think of it this way, if you needed an administrative username and password to access the REST APIs, would you be willing to put that username and password into the JavaScript that you send to the client? No, because you'd be making everyone who visits your website an administrator. The API Keys that allow administrative functions to be performed are exactly the same.

So, if the keys need to be kept secret, keep them secret. They need to live on the server, and the server needs to make the requests to the backend system using the keys, and then the server can turn around and serve the results of the API responses back to the client, sans keys.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .