PRODUCTION SCENARIO
A browser-based scheduling app ships a long-lived API key in its JavaScript bundle and calls Claude directly from the user's device. Before it invokes a calendar-writing tool, it reads the caller's staff role from a hidden form field.
Which change removes both weaknesses at once?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Proxy the calls through a backend that holds the key and verifies the caller's role.
Both the credential and the authorization decision have to sit on a server the user cannot edit: a backend holds the key in a secrets manager and checks the session's real role before the write. Minting a short-lived token fixes the credential but leaves a self-asserted role driving a privileged action. A build-time environment variable is inlined into the bundle by the bundler, so the key still ships. And App Attest issues short-lived tokens only to attested iOS and macOS app installations, not to a web page.
Official Source: https://platform.claude.com/docs/en/manage-claude/authentication ↗