I have a Lightning Web Component that makes a fetch() request straight from the component's JavaScript. For testing and development I've simply stored the API key as a variable, but I'd like to back it up on GitHub and obviously don't want my API key exposed. What is the current best practice for storing sensitive data to be accessed by a Lightning Web Component?
2 Answers
It’s impossible to secure API keys when they are exposed to Javascript. I’m not going to dig into details since the answer is available online. If security is really a concern, you will need to fetch the data in Apex.
In Apex, the best way to store your key without exposing it to the repository is by using custom metadata records as they are not visible to clients when the protected setting is checked off and querying the Custom MDT by using the mtd.get() and mtd.getAll() functions do not contribute towards the transaction limit.
You could store it as custom metadata and access it through the LWC. Page 17: http://resources.docs.salesforce.com/200/9/en-us/sfdc/pdf/custom_metadata_types_impl_guide.pdf Loading custom metadata example: https://www.infallibletechie.com/2021/03/how-to-fetch-and-display-custom.html
