Ajax call hiding API key from client side? - ajax

Question

Firstly, I couldn't find an answer for my problem.
The problem is when I am making a call , I have to add the api key in the header. I am using Ajax but I dont want others seeing the api key from the devtool.
My code looks like this:
$(document).ready(function(){
$("#login").click(function(e){
e.preventDefault();
$.ajax({
type:"POST",
url:'/resource/auth/login',
data: {
username: username.value,
password:password.value
},
headers: { "ApiKey": "mykey" },
success: function(){
alert("Logged in");
Is there a way to hide the value of "mykey", the api call wont work if I dont provide the key in the header
Thanks in advance!

Answer 1

I hope I will work for you, this code for view:
#php
$secret_key = hash('sha256', 'some_secret_key');
$secret_iv = substr(hash('sha256', 'some_secret_iv'),0,16);
#endphp
$(document).ready(function(){
$("#login").click(function(e){
e.preventDefault();
$.ajax({
type:"POST",
url:'/resource/auth/login',
data: {
_token:{{csrf_token()}}
username: "{{openssl_encrypt('your_username','AES-256-CBC', $secret_key, 0, $secret_iv)}}",
password: "{{openssl_encrypt('your_password','AES-256-CBC', $secret_key, 0, $secret_iv)}}"
},
headers: { "ApiKey": "{{openssl_encrypt('your_apikey','AES-256-CBC', $secret_key, 0, $secret_iv)}}" },
success: function(resp){
console.log(resp);
},
error: function(err){
console.log(err);
}
}
);
in Controller's Function you can decrypt is to get username and password:
public function login(Request $request){
$secret_key = hash('sha256', 'some_secret_key');
$secret_iv = substr(hash('sha256', 'some_secret_iv'),0,16);
$username = openssl_decrypt($request->input('username'), 'AES-256-CBC', $secret_key, 0, $secret_iv);
$password = openssl_decrypt($request->input('password'), 'AES-256-CBC', $secret_key, 0, $secret_iv);
$apikey = openssl_decrypt($request->header('ApiKey'), 'AES-256-CBC', $secret_key, 0, $secret_iv)
echo 'Hye! your username is ' $username. ',your password is '. $password .'and your api key is '.$apikey;
}
here openssl_encrypt and openssl_decrypt are php functions, you can read about them in the documentation:
openssl_encrypt:
openssl_decrypt:
Make sure that your secret_key and secret_iv should be same on both sides.