title: How to secure the JavaScript API Access Token?
body: <p>There are numerous online resources which provide JavaScript APIs to access their services. To be more clear, I will base my question on the example of <a href="http://www.mapbox.com" rel="nofollow noreferrer">MapBox</a>, but this applies well to many other services in various domains.</p>
  <p>When someone wants to use such a service in a web application (like the map imagery from MapBox for example), they typically need to Register/Sign Up and obtain an <strong>access token</strong> to access the service.</p>
  <p>Now, if I would use the API from the server side - there is no issue: I know my token is stored securely somewhere on the server and is only exposed upon communication between my server and the service provider, which is OK as long it is HTTP<strong>S</strong>. However, in case of a JavaScript API (for example if I use <a href="http://leafletjs.com/" rel="nofollow noreferrer">Leaflet</a> to render a map from MapBox), I am supposed to have <strong>my access token</strong> in a JavaScript which is exposed to the user's web browser - and so it makes it extremely easy to find someone's access token. My users, or in a case of a public service, literally anyone, would be able to find the token in the browser's &quot;Dev Tools&quot;.</p>
  <p>This token however, as for me, should be considered as a sensetive data - service usage is tracked based on the authentication this token provides. If you pay for the service based on its usage it becomes critical, but even if you don't (like, if you use a Free/Starter/Non Paid plan) - service usage is limited and I'd like to be sure it is only me who uses it.</p>
  <p>Is my only option a proxy via my own web server?</p>
  <p>Is there a way to secure the access token used by a JavaScript API to access an external service, provided that JavaScript is executed in a user's browser?</p>