Prismic - How to make API calls without exposing Access Token
You'd have to store your access token on your server and make it process the requests on behalf of the client.
In the end, you'd send requests to your server instead of directly to prismic.io, your server will then send the access token authorized request, fetch whatever you need and return it back in response to the client.
The work flow would look like this:
- Client sends request to i.e.
http://localhost:8000/api/endpoint - Server sends request to
prismic.ioendpoint associated with the above endpoint. - Server gets
prismic.ioresponse and sends it back to the client. - Client gets the response.
If you want to hide your access token client-side, then it's impossible. To protect your access token the other two options are:
- Make users use their own
prismic.ioaccess tokens. - Allow access only to authorized users.
The two options above are probably not what you want, so setting up a proxy server is what's left.