If I were to build a Twitter or Facebook application using pure client-side technologies like HTML and javascript, how would I mask/hide my API keys?

For example, for Twitter I have consumer key and consumer secret. In order for me to call Twitter's API I'll have to pass these keys to authenticate my app. If I am using pure client side technologies, I leave myself exposed. Therefore, the API keys are up for grab and anyone can authenticate as my app. How can I prevent this? Can I prevent this at all?

This question is very similar to this thread, however, it's not a desktop application.

  • If I am using pure client side technologies In a client-server model, it doesn't make sense to use only client side technologies. As @Morons writes, it can't be done. Any reason you are not using anything server side?
    – yannis
    Dec 6, 2011 at 6:25
  • Frankly, we're are the API provider, rather than the API consumer. We are trying to figure out the easiest way we can allow our consumers consume the API. Trying to figure out how much knowledge will the consumers have to have. The less they have to, the better.
    – Sai
    Dec 6, 2011 at 16:17
  • You should have included that info in the question. It wouldn't have made much difference for this question, but you should be as detailed as you can be, and definitely tells us from which perspective you approach the issue.
    – yannis
    Dec 6, 2011 at 22:47

1 Answer 1


The nature of HTML and Javascript is such that the client has access to all the code.

What you are trying to do is like trying to build an HTML website while securing the HTML code from theft.

This simply can't be done.

  • I was afraid of this answer, however, I figured I'd ask in case someone has some fancy tricks.
    – Sai
    Dec 6, 2011 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.