# Is it fine to expose api key?

**URL:** <https://devforum.zoom.us/t/is-it-fine-to-expose-api-key/50460>\
**Category:** API and Webhooks\
**Created:** [May 18, 2021, 5:42am UTC](https://devforum.zoom.us/t/is-it-fine-to-expose-api-key/50460 "2021-05-18T05:42:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![luke.choi](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/luke.choi/32/21205_2.png) [@luke.choi](https://devforum.zoom.us/u/luke.choi)\
**Post date:** [May 18, 2021, 5:43am UTC](https://devforum.zoom.us/t/is-it-fine-to-expose-api-key/50460/1 "2021-05-18T05:43:00Z")

</div>

**Description**  
First, my English is not so fluent. (Please understand it.)

I test zoom api for my service with pure html, nodejs backend.  
like below image, i wrote code. (left image is html code, middle image is javascript code using in html, right image is backend code.)

i used the dotenv package to not expose my api key in nodejs backend code.  
but in zoom.js (middle image), as for as I know, to join zoom meeting, client side needs to api key.  
like middle image, is it okay to expose **api key** in js file? (it’s okay hide only api secret? )

Thank you.

**Which App Type (OAuth / Chatbot / JWT / Webhook)?**  
JWT

**Screenshots (If applicable)**

 ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/f/3/f32364062132397f8b88246359715f6c4698a6ad.png)

**Additional context**  
Add any other context about the problem here.

---

<div class="post-metadata">

**Author:** ![luke.choi](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/luke.choi/32/21205_2.png) [@luke.choi](https://devforum.zoom.us/u/luke.choi)\
**Post date:** [May 18, 2021, 9:49am UTC](https://devforum.zoom.us/t/is-it-fine-to-expose-api-key/50460/2 "2021-05-18T09:49:09Z")

</div>

I solved it by config.js!

---

<div class="post-metadata">

**Author:** ![alexmayo](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/alexmayo/32/27289_2.png) [@alexmayo](https://devforum.zoom.us/u/alexmayo)\
**Post date:** [May 18, 2021, 11:29am UTC](https://devforum.zoom.us/t/is-it-fine-to-expose-api-key/50460/3 "2021-05-18T11:29:36Z")

</div>

Hey @luke.choi,

Welcome to the community!

To answer your original question, yes it’s fine to expose your api key, providing that the secret is hidden.

Thanks,  
Alex

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [May 18, 2021, 11:32pm UTC](https://devforum.zoom.us/t/is-it-fine-to-expose-api-key/50460/4 "2021-05-18T23:32:44Z")

</div>

Let us know if you have any questions @luke.choi.

Thanks,  
Max

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [June 18, 2021, 9:33am UTC](https://devforum.zoom.us/t/is-it-fine-to-expose-api-key/50460/5 "2021-06-18T09:33:31Z")

</div>

Closed on June 18, 2021, 9:33am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.