0

I am designing an application which uses an API key provided to me by a company.

In order for me to make my application public, I need to hide the API key in my released product, because currently it is sitting in JS code and visible to all users.

My app basically provides real-time statistics, and is completely functional, but only at the JS level.

From my understanding, in order to hide my key, I need to do the following:

Client uses web app --> AJAX call to MY server --> Gets my API key --> AJAX call to company's server --> Return only the object from the company's server to the client web-page.

I have written PHP, JS, SQL, and HTML before so I'm FAMILIAR with the languages, but this chain of events seems a bit over my head.

Usually I buy books to understand this type of thing but it seems like a pretty specific example that some of you guys would be able to help me with.

Can anyone explain how this might be done, using layman's terms? I'm not completely stupid but my biggest roadblock here are the following two concepts:

  1. How can you AJAX call to a PHP page, and tell it to make another AJAX call to an external server?
  2. How do you execute that second AJAX call? Is it just another (hidden) js file?

The stats are provided in real time, so you type a name in, and it generates a graph on the page within less than a second. I want to keep it like this and not have the user refresh the page.

Thanks so much. Let me know if you need any more information from me.

Vranvs
  • 1,411
  • 4
  • 17
  • 38
  • 3
    If you don't want your API key to leak, you have to do everything on your server. If the API key is ever sent out to the client, it's available to anybody who really wants it. – Pointy Aug 29 '15 at 21:36
  • Yes I know that but does this mean I have to convert all my current JS coding to PHP? – Vranvs Aug 29 '15 at 21:45
  • @Vranvs Yes, you have. Because if you just send back the API key everyone can see it if they open the network tab of their browser's developer tool. – Charlotte Dunois Aug 29 '15 at 21:58
  • Okay well then how do you make requests to an API using PHP? – Vranvs Aug 29 '15 at 22:24
  • ..and then return it to be parsed by JS in real-time? – Vranvs Aug 29 '15 at 22:25
  • Usually the company which have provided the API key to you have the documentations and ample codes in different languages on how to integrate the API with your code. so it's better to take a look at their website and look for the documentations. – EhsanT Aug 29 '15 at 23:43

0 Answers0