Securing Access Keys
Keeping your access keys safe in production
When working with Function, it’s crucial to keep your access keys secure, as exposing them can lead to unauthorized use of your services. Depending on the environment you are working in, here are guidelines for securing your access keys.
In the Browser
In browser-based applications, you should never expose your access key directly in your front-end code. Instead, proxy your requests through a backend route that handles the access key securely. Here’s how you can do it:
Create a Frontend Client
In the browser, the Function client should reference an API route on your backend. For example:
Create a Backend Route
On the backend, create an API route that securely handles the access key. For example, if you’re using the Next.js App Router, you can define a route like this:
Make sure to not pass in any inputs
when creating a prediction on the backend.
This ensures that the access key is securely stored on your server, while the browser interacts with your backend to make requests.
In Node.js
For Node.js applications, storing your access key in environment variables is a best practice. This keeps the key out of your codebase and secure on your system.
Create a Dotenv File
Create a .env
file in the root of your project and store your access key like this:
When starting your Node process, you can then reference this .env
file:
Finally, make sure that your .env
file is never committed to version control by adding it to your .gitignore
:
Create a Function Client
The Function client will automatically load the access key from the environment variable when instantiated in your code:
In Unity
In Unity applications, we strongly recommend following the same approach as in the browser:
In other cases, simply ensure that your Function settings for your Unity project are not committed to version control: