I want to use a GTM tag to fire an event call API to another third-party platform. API needs a private key for authorization.
The problem is if I put the private key in tags, it can be shown on the HTML page view.
Can I hide it in somewhere similar to .env in locale?
1
It will only be shown in the DOM if you use it in your HTML tag. Instead, you could use a custom JavaScript variable in GTM or a template. That will hide your API key from the html.
However, it will still be observable if you look one step further in the actual library’s code. You can’t forget that GTM is executed on the client side, which means it will be completely available for any client to analyze. Therefore, it can be easily picked up and used elsewhere. Especially given how we have public GTM parsers available.
It’s generally considered to be a serious security breach to use api keys in GTM if not anywhere else on the front-end.
Consider routing your logic through backend to avoid surfacing the authentication.