Need help with protecting public endpoints WITHOUT user authenticating

[vlad.murarasu]

Hi @fattynomnom,

Welcome to the Auth0 Community!

Unfortunately as stated in this post, the nature of public APIs makes it hard to protect for use by a specific application.

How to authenticate SPA against API without User login

@dtl, Welcome to the Auth0 Community Forum! There is not really any solution for this. Due to the nature of public clients, any global API key or secret that is sent with the application is inspectable by any user who can access the SPA. They can get the key/secret and use the API like they were the SPA. You can obfuscate it to make it more difficult for an average user, but a public client with no unique credential (like a username/password) is going to be able to be inspected. Do you have a…

If you have any other questions feel free to reach out.

Have a good one,
Vlad