Exposing API keys in client-side code
Never embed your API key directly in browser or mobile application code.
Use ephemeral tokens obtained from a secure server endpoint for client-side API authentication.
Including your main API key directly within client-side JavaScript or mobile application code.
Exposing API keys in client-side code makes them vulnerable to theft and misuse, as this code is publicly accessible. Ephemeral tokens provide a more secure, temporary, and scoped alternative.
Avoid embedding API keys in client-side code. Instead, use ephemeral tokens fetched from a server endpoint to maintain security for browser and mobile applications.
Client-side code is inherently insecure as it can be inspected by users. API keys embedded here are easily compromised. Ephemeral tokens, generated server-side and with limited scope and duration, mitigate this risk.
This is always an anti-pattern for client-side code.
- Ephemeral Tokens ↗xAI · xAI Docs: Guides · Jul 20, 2026 · paraphrased
First seen on Subvolts Jul 20, 2026. Updated Sep 11, 2026. Spotted a problem? Tell us.
- Ephemeral TokensxAI · xAI Docs: Guides · Jul 20, 2026
The Playbook: reusable how-tos, prompts, configs and tips pulled out of the news.
- HeuristicUse ephemeral tokens for client-side API accessSecurely connect client-side apps to APIs like Speech to Speech using short-lived tokens instead of API keys. · 15 min
- WorkflowSecure client-side API access with ephemeral tokensSet up a server endpoint to fetch and provide ephemeral tokens for client-side API authentication. · 60 min
- Case studyBuild live translation broadcast app with Gemini and LiveKitIntegrate Gemini 3.5 Live Translate and LiveKit to create a real-time multilingual broadcast app. · 60 min
- Code snippetBuild real-time speech-to-speech voice agents over WebSocketsDevelop low-latency, real-time voice agents using WebSockets for interactive conversations with tool use. · 10 min
- Code snippetClone a voice for custom TTS and speech-to-speech applicationsClone a custom voice from a short reference clip for use in TTS and real-time speech-to-speech APIs. · 10 min
- Code snippetGenerate speech with expressive multilingual voices and tagsCreate spoken audio with diverse voices, inline speech tags for emotion, and various output formats. · 5 min
Questions people ask
- Which AI tools does this work with?
- Any current model. It was seen with in the sources.
- Where did this come from?
- xAI (xAI Docs: Guides). Subvolts collected, normalized and credited it; the link above opens the original.