Hide an API key in file on a disabled page

I would like to make a fetch request from my squarespace site to a weather data provider.  The code works fine when I write it into a code block directly on the page.  My issue is that the code contains an API key that I want to keep secure, yet accessible.

My strategy to keep this "simple" was to use the method described in this article to upload my file that runs the script which uses the API key, and then reference that file using 

<script src="/s/javascriptfile.js"></script>

The biggest question is whether storing an API key in an uploaded file linked on a disabled page and then referencing that file is a secure way to access the API key without showing it to the world.  

The next question is do I really need to wait overnight for the references to uploaded files to work? That is one of the problems noted in the same article.  

Thanks!

On 6/11/2020 at 1:40 AM, elderlyman said:

I would like to make a fetch request from my squarespace site to a weather data provider.  The code works fine when I write it into a code block directly on the page.  My issue is that the code contains an API key that I want to keep secure, yet accessible.

My strategy to keep this "simple" was to use the method described in this article to upload my file that runs the script which uses the API key, and then reference that file using 

<script src="/s/javascriptfile.js"></script>

The biggest question is whether storing an API key in an uploaded file linked on a disabled page and then referencing that file is a secure way to access the API key without showing it to the world.  

The next question is do I really need to wait overnight for the references to uploaded files to work? That is one of the problems noted in the same article.  

Thanks!

The file is included in the site is exposed to the world either you placed it on disable or not, you may need to use a external server to doing the fetch to hide the api token. Can choose between a shared hosting with PHP or VPS with nodejs or simplest form is used Google Apps script published url

@bangank36 Thanks.  Since you say it is the simplest option, I'll start experimenting with  a Google Apps script on a published url.  Are you sure that an API key listed in a script on a public URL would be safe? 

2 minutes ago, elderlyman said:

@bangank36 Thanks.  Since you say it is the simplest option, I'll start experimenting with  a Google Apps script on a published url.  Are you sure that an API key listed in a script on a public URL would be safe? 

If security is the most concern, better use shared host or vps for the api handling

@paul2009 thanks for the thorough answer.  I've been trying to balance a few goals: use a very simple code block (don't turn on dev mode), keep the API key secure as a best practice/to avoid quota theft, and avoid unnecessary complexities that might break.  I can now see how, within the options of the code block or with file uploads, I'm still playing only in the front end. 

Even though I can't do exactly what I wanted, it's nice to have come to some conclusions about what my options are.  

Thanks!