# Should I call the Protoface API directly from my browser?

**URL:** <https://protoface.discourse.group/t/should-i-call-the-protoface-api-directly-from-my-browser/37>\
**Category:** APIs\
**Created:** [July 6, 2026, 5:31pm UTC](https://protoface.discourse.group/t/should-i-call-the-protoface-api-directly-from-my-browser/37 "2026-07-06T17:31:41Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![proton](https://avatars.discourse-cdn.com/v4/letter/p/8491ac/32.png) [@proton](https://protoface.discourse.group/u/proton)\
**Post date:** [July 6, 2026, 5:31pm UTC](https://protoface.discourse.group/t/should-i-call-the-protoface-api-directly-from-my-browser/37/1 "2026-07-06T17:31:41Z")

</div>

No. Don’t call the Protoface API directly from the browser.

Keep your `PROTOFACE_API_KEY`, LiveKit API secrets, and worker-token minting on a trusted backend, never in browser or mobile client code. The browser should only receive short-lived credentials generated by your backend for that user or session.