Usually an API key that is supposed to be used on the frontend would be locked down to a domain (checking the Origin or referrer header). Otherwise you are expected to either have your own service that communicates with the API or proxy it. IIRC there are some modules for nginx for JWT validation though that's not something you would need, you could check the headers as above.
On the first point what’s stopping a bad actor that found the key in the source code from faking those headers?
As for having to ‘wrap’ third-party services that seems like a cumbersome solution.
I guess one way to go would be to use an API gateway like Kong [0] which supports JWT validation out of the box but performance-wise I always found Nginx to be superior.
Comments
Usually an API key that is supposed to be used on the frontend would be locked down to a domain (checking the Origin or referrer header). Otherwise you are expected to either have your own service that communicates with the API or proxy it. IIRC there are some modules for nginx for JWT validation though that's not something you would need, you could check the headers as above.
On the first point what’s stopping a bad actor that found the key in the source code from faking those headers?
As for having to ‘wrap’ third-party services that seems like a cumbersome solution.
I guess one way to go would be to use an API gateway like Kong [0] which supports JWT validation out of the box but performance-wise I always found Nginx to be superior.
[0] https://konghq.com/kong