How are you hiding the API token?

[ben8622]

I am trying to copy what this project is doing, but anytime I do a deploy the secrets.REACT_APP_GITHUT_API_TOKEN it gets leaked in the resulting ./build files. How are y'all working around this and still being able to hit the API with a purely frontend application?

[ben8622]

Never mind, I see you aren't hiding it at all. I can just grab it right out of the developer tools and use it myself. I do find it funny that Github doesn't automatically expire your token like it was doing so with mine. Maybe it has to do with the fact you're using the graphql api and not the REST one. Not sure tbh but at least I am no longer throwing my head into the wall.

[sadapasta]

just converting it to base64

[ben8622]

I didn't see where you're doing that, but I can still grab your api key easily.