API leaked in server side (accidentally)

Anvil Q&A
1

Hi there,

I was hard coding some API keys in my server code after discovering App Secrets.

Now I realise that someone has been using my API key, which I only posted there.

Is it server code safe for any external user? Would it mean that someone could access the server code?

Regards

2

My understanding is server side is not accessible by the client. But if there is a method that sends that api request to the client with the API key in the request, the client will be able to see the key.

2 Likes
3

Thank you for the response.

Already found that I leaked my API key by error sharing my project.

Bear that in mind when sharing your code with others!

2 Likes
4

Sorry to hear that!

I have definitely been there. I would suggest looking into Anvil Docs | Encrypting Secret Data Documents. It allows you to share your application without worrying about all your sensitive keys.

5

For anyone later reading this who tldr’d the Docs link above, the cliffnotes version is:

  1. Install The Secrets Service in your app
  2. Put your API keys in the secrets service with a “Name” for that secret.
    (Like ‘StripeAPIkey’ or something)
  3. When connecting with the API inside the app server module, use something like:
anvil.secrets.get_secret('StripeAPIkey')

To retrieve the secret information.

This way even if you share your app or you make a git clone public, theres nothing for anyone to have access to, unless they already have access to your anvil IDE.
(…by then everything would be up for grabs at that point so who cares)

3 Likes