I’d like to create a simple JavaScript app that asks a user for their API key from a third-party service and makes it easier to use the service with a better GUI. There will be no server-side code on my side, opensource, hosted on GH. So, the question is:

1. Is it secure at all, or should I forget it? How could the key be leaked?
2. Can you preserve the API key between sessions? Perhaps using a browser-based password manager?

I’m considering using a password input and generating custom request() function that scopes the provided api key during the session:

function createRequest(apiKey) {
    const apiUrl = 'https://example.com/data';
    return function request() {
        fetch(apiUrl, {
            method: 'POST',
            headers: {
                'Content-Type': 'application/json',
                'Authorization': `Bearer ${apiKey}`
            },
            body: JSON.stringify({data: 'example'})
        })
        .then(response => ...)
    }
}