How can I send secure API requests from SvelteKit app, without showing API keys on the client side?

I’m using Supabase for a new Sveltekit app, with this template (https://github.com/joshnuss/svelte-supabase)

Currently, I’m passing the Supabase keys through on the client side, like this:

const supabase = createClient(
  import.meta.env.VITE_SUPABASE_URL,
  import.meta.env.VITE_SUPABASE_ANON_KEY
)

What is the simplest way that I can create a secure backend/API, so the application can fetch content from Supabase, without showing Supabase key on the client side?

Is there any functionality built into Sveltekit that enables me to do this? Or would I need to integrate a backend like Rails?

[dominikg]

enabling github discussions could also be an option

[lsabi]

@AleCandido it doesn’t matter if it’s static or dynamic. In order to generate a static website, you need to run the whole app and get the pages. In order to get the pages you have to perform the request to the API. In my case I was forwarding the requests via a middleware and adding the secret API key.

That’s why I was confused and would like the docs to describe it in details. The middleware was a really nice thing to have in sapper and can slow down the development/transition to kit.

I solved my problem with an endpoint that forwards every request, though it doesn’t feel the right approach…