Over the last few years, the trend for client-side (browser) applications has really taken off.
For my latest project, I have decided to try and move with the times and write a client-side application.
Part of this application involves sending transaction emails to users (for example, validate signup, password reset emails, etc.). I am using a third-party API to send the emails.
Normally I would have my application running on a server. I would call the third-party API from code on my server.
The first glaring issue I can see is I need to use an API key. This would normally be safely stored on my server, but now presumably I will need to provide this key to the client browser.
I guess my general question is - how can we prevent malicious use of a client-side application?