RealComposer
START FREE
Client PlatformsOfficial Jamstack Sites docs

Jamstack Sites Safe & Unsafe Practices

Direct Answer

Static Jamstack sites have no server at request time, so any key referenced in their JavaScript is public. Fetch secret data at build time or through an edge function or proxy, and configure CORS on the endpoint rather than relying on the browser.

Credentials & Where They Belong

Server only
Build-time secrets

Safe in the build environment if never written into output files.

Client safe
Runtime client tokens

Revocable tokens for calling your own proxy.

Safe Practices

  • Move dynamic calls to an edge proxy

    Edge endpoints add secrets, CORS, and caching without running a server.

  • Rebuild or revalidate for content updates

    Prefer build-time fetching for content that rarely changes.

Unsafe Practices

  • Inlining API keys into static JavaScript

    Every visitor downloads the key with the page.

  • Using CORS proxies run by third parties

    Public CORS proxies can log or modify your traffic and credentials.

The RealComposer Pattern

Replace serverless glue with a RealComposer pipeline: one edge URL with OPTIONS handling, vault secrets, and cached responses.

START BUILDING FREE

Frequently Asked Questions

Q:How do static sites call private APIs?

Through an edge function or proxy that holds the secret and returns only safe data.

Jamstack Sites Recipes

All Static HTML / Jamstack recipes (4)
Static HTML / JamstackREST API
Multi-API Aggregation

Lightweight API Gateway for Jamstack and Static Sites

To solve lightweight api gateway for jamstack and static sites, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe

Related Concepts

Jamstack Architecture

Jamstack is a web architecture where sites are prebuilt into static files served from a CDN, with dynamic functionality provided by JavaScript calling APIs at runtime. It delivers fast, secure pages because there is no origin server rendering each request.

CORS Preflight & Edge Proxying

Cross-Origin Resource Sharing (CORS) is a browser security protocol that restricts web applications from making API requests to a different domain unless the server explicitly grants permission via HTTP headers. Edge proxies resolve CORS errors by terminating browser preflight OPTIONS requests directly at the edge.

Edge Functions

Edge functions are serverless code that executes in data centers distributed worldwide, physically close to end users, rather than in one central cloud region. They intercept HTTP requests to run logic like authentication, routing, caching, and response transformation with minimal latency.