Architecture Comparison

Client-Side API Calls vs an Edge Secret Vault

Direct Answer

Any secret shipped in a web bundle, mobile binary, or low-code app can be extracted by the people using it, so calling private APIs directly from the client is only safe with keys the vendor designed to be public. An edge secret vault keeps server-only keys encrypted, injects them into upstream requests at the edge, and gives the client a restricted, revocable token instead. Use direct client calls only for publishable keys; route everything else through the vault.

Edge secret vault

Server-only keys stay encrypted at rest and are added to upstream requests at the edge; clients authenticate with a scoped client token.

Direct client-side calls

The browser, mobile app, or low-code builder calls the upstream API itself with a key embedded in the client.

Side-by-Side Comparison

Dimension	Edge secret vault	Direct client-side calls
Key exposure	Server-only keys never reach the device	Keys visible in bundles, binaries, and network logs
Revocation after a leak	Revoke the client token; upstream key unchanged	Rotate the upstream key and ship a new client release
CORS	One allowed origin policy on your endpoint	Blocked when the vendor API does not allow browsers
Abuse and billing risk	Rate limits and caching in front of the vendor	Anyone with the key can run up your bill
Latency	One extra edge hop, often offset by caching	Direct, but multiple calls per screen
Setup effort	Store key once, map the response	Paste the key into the client

Choose Edge secret vault when

The key can read or write customer, billing, or AI usage data.
You ship a mobile app or low-code app where you cannot hide anything.
You need to revoke access without forcing an app update.

Choose Direct client-side calls when

The vendor issues a publishable key designed for browsers, scoped by domain or bundle ID.
The data is public and abuse would not cost you money.

Frequently Asked Questions

Does obfuscating a key in my app make client calls safe?

No. Obfuscation slows down casual inspection, but the key is still sent over the network where a proxy or DevTools can read it. Treat any embedded secret as public.

Which keys are safe to use in the client?

Only keys the vendor documents as publishable, such as payment publishable keys or restricted public tokens. Each stack guide marks every credential as client-safe or server-only.

How does the client authenticate to the edge vault?

With a restricted client token scoped to specific pipelines. If it leaks, you revoke it without touching the upstream secret.

Sources & Definitions Used in This Answer

Try the edge approach on your own APIs

Clone a recipe, add your upstream keys to the vault, and call one endpoint from your client.

BROWSE RECIPES