Response contains my API key

[melissamcewen]

Right now when I do:

base('mybase').select({
    // Selecting the first 3 records in Grid view:
    maxRecords: 3,
    view: "Grid view"
}).eachPage(function page(records, fetchNextPage) {
    // This function (`page`) will get called for each page of records.

    records.forEach(function(record) {
        console.log('Retrieved', record.get('Ingredient'));
    });

    // To fetch the next page of records, call `fetchNextPage`.
    // If there are more records, `page` will get called again.
    // If there are no more records, `done` will get called.
    fetchNextPage();

}, function done(err) {
    if (err) { console.error(err); return; }
});

The response (that's console logged here) contains something that looks like this:

{
      "_table": {
        "_base": {
          "_airtable": {
            "_apiKey": "myrealapikey",
            "_endpointUrl": "https://api.airtable.com",
            "_apiVersion": "0.1.0",
            "_apiVersionMajor": "0",
            "_allowUnauthorizedSsl": false,
            "_noRetryIfRateLimited": false,
            "requestTimeout": 300000
          },
          "_id": "something"
        },
        "id": null,
        "name": "something"
      },

This causes some issues when I'm working on for example doing live coding or demo projects (I work in developer education). This happened to a colleague of mine and he had to reset his key.

[EvanHahn]

That's surprising! Is that happening from this line?

console.log('Retrieved', record.get('Ingredient'));

Or another one?

[melissamcewen]

Yes, if I console log the whole record. Here's a working example. If you could see the console logs you could see my API key https://glitch.com/edit/#!/scaretable-page-request?path=server.js:43:51

[melissamcewen]

ahh it's not the server response, it's just the way the SDK is formatting the stuff for me to use.

[syrnick]

Correct, that's not in the server response, but rather in the in-memory representation on the client.

That said, it is fixable. I.e. we can probably fix it so that accidentally logging any objects returned by the SDK does not reveal the API key.

[melissamcewen]

Ah cool, yeah that would be a great service for us using the API to teach and livestream.

[EvanHahn]

We believe we've fixed this in #83 and will deploy a new version of Airtable.js soon!

[EvanHahn]

A fix for this has been published in [email protected]. Let us know if this helps!