# Storing the API key

**URL:** <https://forum.mupdf.com/t/storing-the-api-key/185>\
**Category:** WebViewer\
**Created:** [October 27, 2025, 4:32pm UTC](https://forum.mupdf.com/t/storing-the-api-key/185 "2025-10-27T16:32:05Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![39rc](https://yyz2.discourse-cdn.com/flex004/user_avatar/forum.mupdf.com/39rc/32/256_2.png) [@39rc](https://forum.mupdf.com/u/39rc)\
**Post date:** [October 27, 2025, 4:32pm UTC](https://forum.mupdf.com/t/storing-the-api-key/185/1 "2025-10-27T16:32:05Z")

</div>

Hi,

In the [docs](https://webviewer-docs.mupdf.com/getting-started#initialization) the api key is stored as a string in the javascript files.

Is this the official way to do it? I’m concerned that a user may read the js bundle and take the API key.

Thanks

---

<div class="post-metadata">

**Author:** ![Jamie\_Lemon](https://yyz2.discourse-cdn.com/flex004/user_avatar/forum.mupdf.com/jamie_lemon/32/5_2.png) [@Jamie\_Lemon](https://forum.mupdf.com/u/Jamie_Lemon)\
**Post date:** [October 28, 2025, 2:46pm UTC](https://forum.mupdf.com/t/storing-the-api-key/185/2 "2025-10-28T14:46:49Z")

</div>

The API key is locked to the domain that you register for.

So, for example if you register a key for [39rc.com](http://39rc.com) then the key only works on `39rc.com`. It can’t be used anywhere else.

In theory, yes I think a user could extract the license key from the JS bundle, but they can’t do anything with it unless they have deployment access to your web domain. In this way the key is kind of safe to expose.