title: Where to "hide" an API key
body: <p>My question is about where and how to: </p>
  
  <ol>
  <li>hide an API key</li>
  <li>access the hidden API key in my app.js file</li>
  </ol>
  
  <p>In this case I am dealing with an Algolia Admin API Key (but aiming to ask this question in a fairly generic way).</p>
  
  <p>In order for my app to work, based on certain user actions I need to update my Algolia index (which requires an Admin API Key in order to do).</p>
  
  <p>I understand that I am not supposed to expose my Admin API Key to the front-end (i.e. don’t put it in my app.js file). How can I securely pass my API Admin Key to my app.js file, so that I can make updates to my Algolia index?</p>
  
  <p>Some things I've come across:</p>
  
  <p>-Should I hide it in a <code>config.json</code> file? I can't figure out how use information exported from a config file in my js (which maybe would defeat the purpose anyways?). I read <a href="https://stackoverflow.com/questions/38404816/reading-a-config-file">this</a></p>
  
  <p>-Also on the Firestore docs it mentions, in reference to working with Algolia, that "App ID and API Key are stored in functions config variables". How do I store my API key in config variables?</p>
  
  <p>-I read <a href="https://hackernoon.com/how-to-use-environment-variables-keep-your-secret-keys-safe-secure-8b1a7877d69c" rel="nofollow noreferrer">this</a> about using environment variables, and exporting them to the app.js file. But if I then push the app-env file to the server (which I assume I'll need to in order for the app.js file to read the API key) how is that more secure than just putting it in the file?</p>