What is the recommended practice for storing client credentials in an API Integration?

• A. Expose in JavaScript on the client side
• B. Store in local storage
• C. Never expose on the client side and store securely
• D. Put in URL query parameter

Answer: (C)

Keep credentials on the server and store them securely. For an API integration, the client should never see secrets like API keys or client secrets. Your backend should hold these credentials in a secure store (environment variables, a secrets manager, or encrypted vault) and perform the API calls on behalf of the client. This dramatically reduces the risk of exposure because code running in the browser, localStorage, or URL parameters can be inspected, accessed by malicious scripts, or logged in browser history and server logs.

If you need to authenticate requests from a client, use short-lived tokens obtained through a secure server-side flow, and keep the actual secrets hidden from the client. Ensure all communications occur over TLS and rotate credentials regularly.