Is the API key in the Rest API secure?

[loukas]

I believe this is FALSE

Is the API key in the Rest API secure?

From what I understand, as long as the key is passed as a header inside the plugin editor, it’s secure. But if you’re storing the API key as a variable (which is exposed upon page load) or the API key is in the API URL you are calling (such as a parameter), then it would be exposed. Here is a great Security 101 video that WeWeb published just a couple weeks ago that has more on this: Build secure web-apps with no-code tools - YouTube

Source:

@Joyce

All calls made with the REST API plugin our made client-side and should NOT contain any secret API key.

Can someone please confirm so I Leave or Delete this ?