For my website, I am looking to incorporate the Sign In With LinkedIn feature for user logins. The initial example snippet provided in the LinkedIn API docs is as follows:
<script type="text/javascript" src="//platform.linkedin.com/in.js">
api_key: YOUR_API_KEY_HERE
authorize: true
onLoad: onLinkedInLoad
</script>
<script type="text/javascript">
// Setting up an event listener for making API calls post authentication
function onLinkedInLoad() {
IN.Event.on(IN, "auth", getProfileData);
}
// Handling successful API call responses
function onSuccess(data) {
console.log(data);
}
// Handling error responses from API calls
function onError(error) {
console.log(error);
}
// Using the API wrapper to request basic profile data of the member
function getProfileData() {
IN.API.Raw("/people/~").result(onSuccess).error(onError);
}
</script>
I'm concerned about exposing MY_API_KEY_HERE publicly. Are there any secure ways to implement this? Although there are npm packages available for handling this scenario, most of them are outdated and haven't been updated in quite some time.
My application is built using node and express. Should I opt for one of the older npm packages or is there a more effective way to protect the api_key?