Web Security · Junior · Question 70 of 75

A React app needs a payment provider's secret API key. Where should it live?

✓Correct answer: Only on the server: the front end calls your own backend, which uses the key
2In the bundle, but split into several variables to hide it
3In a .env file read by the front-end bundler

Explanation

Everything shipped to the browser can be read in DevTools. Only public keys (like a publishable key) can be in front-end code.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.