Use WP admin AJAX url to hide API key

Question

Currently I am using AJAX to request a simple JSON response from an external API. The problem is, that the API key is exposed. I'm aware the best method is to process this through admin-ajax and set call the url through PHP. What is the most secure method to do this, and how can this be requested through PHP?

$.ajax({
  type: "GET",
  url: "https://link.to/api/v2/link?time=day&key=(APIKEYHERE)&response_type=json",
  data: dataString,
  dataType: "json",

  //if received a response from the server
  success: function(response) {
      console.log(response);
  }, 
});

Answer 1

I would break this problem in to 2 parts.

First, you could sent an Ajax request to your server, sending only the dataString variable.

Then, you can use either cURL or wp_remote_get() on the server to access the real API.

This could be the only solution, if you want to avoid playing hide and seek with hashes and writing tons of code just to make it hard for the users to find the API key.

Answer 2

It depends on what the external API offers, basically read/write access to some data.
I think:

• If your website visitor is allowed those access/permissions on that data, it is ok.
• If your website visitor is not allowed those access/permissions on that data, it is not ok.

Think of Google and Facebook, they provide app and user api keys.
That will depends on your use case.
But i can say that if the external API data access is sensible you should do that on the server and go throw AJAX or REST.