will private api token be exposed?

Hi all, just noted this particular snippet in the documentation, particularly

please note that the token will bleed in the front-end

prismic: {
  // example querying a private Prismic repository
  // please note that the token will bleed in the front-end
  apiOptions: {
    accessToken: 'yourAccessToken'
  }
}

Am wondering what does this line means, and am curious if the private API token is exposed, and what is the best way to implement such a configuration in Nuxt, such that the private API token is protected?

[lihbr]

Hey @gabrielsze, nice question!

Since Prismic has to be able to run on the frontend (for SPA fallback, previewing content, etc.) the token you pass as an option here will eventually bleed in the frontend.

If you’re using a token to protect unreleased content, you can effectively use this option by providing it an access token that only has access to the master ref. People won’t be able to peek at unreleased content this way.

However, if you want to completely protect your content, while hiding the token, I’m afraid it’s not possible now to do so with this module, and Nuxt overall. Once Nuxt Nitro will be released we might be able to use it to proxy calls to Prismic through a serverless function. In the meantime the option available to you is to write an API that acts as a proxy and handles calls to Prismic, injecting your token there. Just want to give you a heads up regarding that as there might be no need to do so with your content since it will most likely be public at the end of the day?

Let us know if anything, cheers!

[lihbr]

You’re welcome, closing this now~

Feel free to reopen if any question, also we have a community forum where you can get support for that kind of question 🙂