Hi!
I have a project which uses a firebase realtime db. When I share the project and access it through a shareable link, the API key and the database URL are stripped. I am confused, because the “Share project by link” modal specifies “Users who click this link will get a copy of this project and all its media assets and data, including API keys & passwords.”.
I am using the beta version of thunkable and am under a free plan. My project is public.
Is this a bug? Thanks!
No, I don’t think this is a bug, but rather a safety feature. You shouldn’t share your API Key with anyone.
Sharing the API key and the database URL does not cause a safety issue as these are bundled with the app anyways. The app needs these to communicate with the database. If this is a safety feature, it is security by obscurity unless the app isn’t published.
@domhnallohanlon or @jane can confirm this but I believe the message about the API key being included is outdated. I think it gets stripped from all shared projects. And yes, it’s for security purposes. Many APIs have limits to how many calls can be made per day and many also charge fees for each call.
When you publish your app, it will have the private API key included. It’s just the shared links that don’t have that.