Does someone know why Sitecore expose your API_KEY with jss forms. Create a simple form, open chrome dev tools (network tab) and click submit.

You will see something like this:


where {your_producion_key} is the value store in your environments variables .env SITECORE_API_KEY=.

1 Answer 1


I assume that you are using the Sitecore CMS to build the PUBLIC facing website and in this case if anyone track the API key via browser then they will be able to see only known content which available publicly.

Other option is to add proxy and don’t expose actual url of call with api key

  • Make sense, Im not a Sitecore dev so didn't know you can give read only access to the app keys.
    – jgatjens
    Commented Jan 8 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.