# Are API keys in theme components okay?
**URL:** https://meta.discourse.org/t/are-api-keys-in-theme-components-okay/367528
**Category:** Development
**Created:** [May 25, 2025, 12:56pm UTC](https://meta.discourse.org/t/are-api-keys-in-theme-components-okay/367528 "2025-05-25T12:56:27Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@NateDhaliwal](https://meta.discourse.org/u/NateDhaliwal)
#### Post date: [May 25, 2025, 12:56pm UTC](https://meta.discourse.org/t/are-api-keys-in-theme-components-okay/367528/1 "2025-05-25T12:56:27Z")
If I were to make a TC that requires the admin/moderator to input an API key as part of a theme setting, would that be safe? I know I could do a plugin which is safer, but a plugin seems like much more work.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [May 25, 2025, 1:01pm UTC](https://meta.discourse.org/t/are-api-keys-in-theme-components-okay/367528/2 "2025-05-25T13:01:45Z")
Theme settings are available to the client JS app, so that means any visitor to your site could check the source code to see them. You almost certainly don’t want to put an API key there.
The exception would be for API keys that are _designed_ for client-side use, and therefore aren’t a concern if anyone gets access to them (e.g. Giphy, Google Maps embeds, etc.)
---
### Author:  [@NateDhaliwal](https://meta.discourse.org/u/NateDhaliwal)
#### Post date: [May 25, 2025, 1:02pm UTC](https://meta.discourse.org/t/are-api-keys-in-theme-components-okay/367528/3 "2025-05-25T13:02:46Z")
Got it. A plugin’s what I’ll go with.
Thanks!
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [June 24, 2025, 1:03pm UTC](https://meta.discourse.org/t/are-api-keys-in-theme-components-okay/367528/4 "2025-06-24T13:03:19Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.