enter image description here

As you can see in the image above, the API key is clearly visible to all people to see. If you simply follow the URL you get the message:

    "errors": [
            "message": "No query was provided!"

With simple Googling you can figure out how to retrieve data from the database.

Is there a way to hide the api key from the network tab?


The API Key which is passed via sc_apikey parameter is not any secret key. It's just and ID of a OData Item settings item.

Now it's all up to you what you allow to read from the databases using that key.

In the most simple scenario, you only allow reading e.g. from web database using anynomous user credentials, so you only allow reading items which has read access rights allowed for everyone. This data is public anyway.

You can limit the data which can be accessed with that API key using fields on that item. I copied bullet points from https://nshackblog.wordpress.com/2018/01/07/using-the-odata-item-service-in-sitecore-9-step-by-step/ :

  • Database – fairly self explanatory, the Sitecore database you’re retrieving an item from.

  • Search Filter – we can apply search options using an OData filter format, I’ve left this as the default which will return the latest version of items.

  • CORS Origins – which origins are allowable? Add your required origins separated with a semicolon. As I’m testing this on Helix Base I have added the relevant origin.

  • AllowedControllers – you may wish to restrict this API Key to certain controllers and can list those here separated with a semicolon. I’m allowing all so have opted for the wildcard *

  • Impersonation User – you could leave this blank in which case Sitecore will use the default from your Sitecore.Services.AnonymousUser setting. The default is most likely sitecore\ServicesAPI but I’ve added this to the field anyway.


With Sitecore JSS you can actually hide the API Key if you want.

It works on the following way:

The Node.js process do the request server side, so it is not visible for the end-user in the web browser. Also because the end-user and the browser are connection to the Node.js server, the hostname and port from the Sitecore server itself is not visible, and you can set restrict access to the Sitecore server. For the media you can use a proxy or CDN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.