# Where should I put the API keys of discourse so that I can fetch the posts?

**URL:** <https://meta.discourse.org/t/where-should-i-put-the-api-keys-of-discourse-so-that-i-can-fetch-the-posts/224177>\
**Category:** Development\
**Tags:** rest-api\
**Created:** [April 13, 2022, 3:08pm UTC](https://meta.discourse.org/t/where-should-i-put-the-api-keys-of-discourse-so-that-i-can-fetch-the-posts/224177 "2022-04-13T15:08:27Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![blake](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/blake/32/157322_2.png) [@blake](https://meta.discourse.org/u/blake)\
**Post date:** [April 13, 2022, 3:30pm UTC](https://meta.discourse.org/t/where-should-i-put-the-api-keys-of-discourse-so-that-i-can-fetch-the-posts/224177/5 "2022-04-13T15:30:34Z")

</div>

> [@Allen\_Chen](#):
>
> I’m doing it in nextJS

I’m not familiar with nextJS so I’m not totally sure, but looks like nextJS uses a tool called SWR to make api requests

> **[Data Fetching: Client-side Fetching | Next.js](https://nextjs.org/docs/pages/building-your-application/data-fetching/client-side)**
>
> Learn about client-side data fetching, and how to use SWR, a data fetching React Hook library that handles caching, revalidation, focus tracking, refetching on interval and more.

You need to be _ **VERY** _ careful the scope of the API key you are storing client side and which api calls you make to Discourse so that you don’t expose your global API key to users since it looks like nextJS is a client side framework instead of server side. The proper way is probably to have next.js make a server side api request that then makes an authenticated api call out to your Discourse instance.

This answer might help you out:

> <https://stackoverflow.com/questions/65862928/how-to-send-headers-using-swr/65863845#65863845>

> As per the docs [Arguments](https://swr.vercel.app/docs/arguments) you should do
> 
> ```
> const fetcher = (url, token) =>
> axios
> .get(url, { headers: { Authorization: "Bearer " + token } })
> .then((res) => res.data);
> 
> const { data, error } = useSWR(
> [`http://localhost:8000/api/v1/users/get-avatar`, auth.token],
> fetcher
> );
> if (error) console.log(error);
> if (data) console.log(data);
> 
> ```

---

_[View the full topic](https://meta.discourse.org/t/where-should-i-put-the-api-keys-of-discourse-so-that-i-can-fetch-the-posts/224177)._