Unverified50% confidenceCautionExact time
API密钥应留在后端而非前端，因为前端代码对用户完全透明，任何嵌入其中的密钥都能通过浏览器开发者工具获取
1
Sources
50%
Confidence
Long-term
Relevance
8/12/2026
First Seen
Sources
Related Claims
UnverifiedOne API的二次分发Key机制借鉴了OAuth 2.0中的令牌委托模式，原始Key仅存储在服务端67% similarVerifiedAPI Keys are attached to HTTP request headers, and the server confirms the requester's identity and permissions by validating the Key.66% similarUnverifiedWeb端遵循RFC 6265标准Cookie规范，身份状态以HttpOnly、Secure标记的会话Cookie存储在浏览器沙箱中，不涉及设备级API调用61% similarUnverifiedBy having web pages proactively define tool boundaries through WebMCP, AI can only call the functional interfaces explicitly authorized by the website rather than arbitrarily operating any page element, providing structural safeguards for security.61% similarUnverifiedKeyv 被众多框架和工具链纳入依赖树，包括 HTTP 客户端 got 等60% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/735070API
curl https://kongchang.com/api/v1/knowledge/claims/735070MCP
get_claim(id=735070)