Is it fine to expose api key?

[luke.choi (Luke)]

Description
First, my English is not so fluent. (Please understand it.)

I test zoom api for my service with pure html, nodejs backend.
like below image, i wrote code. (left image is html code, middle image is javascript code using in html, right image is backend code.)

i used the dotenv package to not expose my api key in nodejs backend code.
but in zoom.js (middle image), as for as I know, to join zoom meeting, client side needs to api key.
like middle image, is it okay to expose api key in js file? (it’s okay hide only api secret? )

Thank you.

Which App Type (OAuth / Chatbot / JWT / Webhook)?
JWT

Screenshots (If applicable)

Additional context
Add any other context about the problem here.

[luke.choi (Luke)]

I solved it by config.js!

[alexmayo]

Hey @luke.choi,

Welcome to the community!

To answer your original question, yes it’s fine to expose your api key, providing that the secret is hidden.

Thanks,
Alex

[MaxM]

Let us know if you have any questions @luke.choi.

Thanks,
Max