Securing API Key in Angular2
First, as @eesdil said, you must use HTTPS. In that case, all your calls are encrypted and safe.
In my example ( Angular 2, Express and JWT ), i used crypto module with pbkdf2 algorithm for hashing passwords.
This is workflow:
- /login/signup -> hash password and generate salt -> store it on server
- /login -> validate password against stored one -> generate jwt -> save it in localStorage on client
- /api -> send jwt in Auth header -> validate on server -> send response
Working example is here: https://github.com/vladotesanovic/angular2-express-starter
Your token hopefully travels with https. And when it does they cannot get it...
UPDATE
from wiki:
Because HTTPS piggybacks HTTP entirely on top of TLS, the entirety of the underlying HTTP protocol can be encrypted. This includes the request URL (which particular web page was requested), query parameters, headers,