Filepicker API key

Question

I like to ask a newbie question. By setting API key in JavaScript, wouldn't anyone can read the source and use the key freely?

Edited >>

Extracted the jsFiddle codes,

filepicker.setKey('8PbzrhP9Tr2r6wPlSqzS');

/* Unsecured */


/*
filepicker.pick(function(fpfile){
   console.log(fpfile);
});

filepicker.read(fpfile, function(contents){
    console.log(contents);  
})
*/


var fpfile = {'url': 'https://www.filepicker.io/api/file/KW9EJhYtS6y48Whm2S6D'};
var policy = 'eyJoYW5kbGUiOiJLVzlFSmhZdFM2eTQ4V2htMlM2RCIsImV4cGlyeSI6MTUwODE0MTUwNH0=';
var signature = '4098f262b9dba23e4766ce127353aaf4f37fde0fd726d164d944e031fd862c18';


filepicker.read(fpfile, {policy: policy, signature:signature}, function(contents){
    console.log(contents);  
})

filepicker.pick({policy: policy, signature:signature}, function(fpfile){
   console.log(fpfile);
});

How does it prevents anyone from using the key ONLY, to upload or read/download files from my account?

Answer 1

Because browser-side javascript is always publically readable, your API key will be visible to others. To increase the protection of your API key beyond simple url/hostname checking, you can use the rich policy-based security API we provide: https://developers.filepicker.io/docs/security/