[Question]: Is it a good idea to mask the Alchemy API URL when dealing with smart accounts?

[ocxyz]

Do I need to have a backend proxy for API URL?

const client = createAlchemySmartAccountClient({
  chain: polygonAmoy,
  rpcUrl: "/api/rpc",
});

or it is okay to use the original URL in the frontend?

const client = createAlchemySmartAccountClient({
  chain: polygonAmoy,
  rpcUrl: "https://polygon-amoy.g.alchemy.com/v2/xxxx",
});

Having a proxy as you know would increase our egress bill and we would like to learn if it is worth it.
Are there known security concerns we need to watch out for?

Thanks for reading.

[moldy530]

That api key should be treated as a secret that you don't want to expose on the frontend, we highly recommend the proxy. otherwise, if someone gets your key then they can use it to make RPC requests on your behalf (increasing your alchemy bill)

[moldy530]

it's still worth noting that even by moving it to the backend behind a proxy, you'll probably want to add additional checks in your backend to avoid someone just calling your API directly (ie. rate limits or authentication)