Next.js Discord

Discord Forum

NEXT_PUBLIC environment variables

Unanswered
Sun bear posted this in #help-forum
Open in Discord
Sun bearOP
From what I read, NEXT_PUBLIC env variables are exposed to the browser.
But say I have some package I need to instantiate client side, then how could I do that without exposing the variable?
So basically would it be fine to expose some secrets I need to instantiate packages client side via NEXT_PUBLIC?

10 Replies

tafutada777
variables that start with NEXT_PUBLIC are inlined(replaced) into JS files, which are being downloaded to web browsers. unlike native apps, there is no mechanism to bake secrets in JS codes. so u should not expose it as everyone can read it.
Sun bearOP
Yeah but then how would I use this: https://github.com/Airtable/airtable.js

It says I need to pass in a secret api token: Airtable.configure({ apiKey: 'YOUR_SECRET_API_TOKEN' })
But how would I do that client side @tafutada777 ?
tafutada777
the official doc says its designed for internal use like only for ur company staff members. they also support OAuth.
If you are building an integration that allow other users to grant your integration access to Airtable, you should instead create an OAuth integration.
Sun bearOP
hmm ok maybe a bad example, but heres another:
https://www.npmjs.com/package/@octokit/core

It says
// Create a personal access token at https://github.com/settings/tokens/new?scopes=repo
const octokit = new Octokit({ auth: `personal-access-token123` });


So thats not possible to use client side?
tafutada777
you might want to how OAuth2 works in general.
Sun bearOP
mhmm yeah I do know, but like if i want to use Octokit I have to initialize it with my token. Do I have to make a request every time I use it to get the token then?
tafutada777
OAuth2 privider token can be stored in JWT or DB. In general one uses Auth.js, it comes in handy.