Draw the boundary before building the screen
In the hypothetical hiking app, the walker types offline maps and presses Search. The device should send that intent to your application backend, not receive the credential that pays for archive retrieval. A browser bundle can be inspected; a distributed mobile application can also reveal embedded strings or outgoing headers. An exposed build-time value is not made private by calling it an environment variable.
Keeping the key on your backend changes what a released client must know. It needs your app’s request contract, such as a search phrase and an allowed community. Your server supplies the archive authentication header. This architecture still requires access controls and careful operation; moving a secret does not make the whole application automatically secure.
Accept a small app request
For a first version, your backend might accept a search phrase and a page number while setting subreddit=hiking and limit=3 itself. Validate lengths and ranges, and allow only options the app actually supports. Do not accept a client-provided archive host, arbitrary query DSL or an arbitrary authentication header to forward. This is a proposed app boundary, not an extra endpoint implemented by Reddit App API.
Use either X-API-Key or Authorization: Bearer when the backend calls the archive. Invalid parameters rejected before a retrieval reservation do not cost a credit; successful empty results do. Validation helps users correct mistakes and keeps the integration predictable. It does not prove that a requested date is covered by the archive or that a valid search will return useful records.
Keep account login separate
The service website’s Secure HttpOnly session cookie lets the account operator manage the account and invoices. The API key authenticates retrieval from your backend. The walker’s login to your hiking app, if you implement one, is another relationship. Do not send a service-account cookie to walkers or interpret a service-key 401 as evidence that their app session has expired.
Your API key and account balance are tenant-specific, meaning they are not shared across the domain network. Store the redditapp.com credential with an explicit domain label. A key from another brand will not become valid by changing the destination URL. Network-wide trial eligibility does not turn those separate account balances into a shared pool.
Review logs as part of the secret boundary
When you move the API key to your backend, you must also be careful about how you log it. Review request traces, exception reports and observability integrations for copied authentication headers. Keep a useful diagnostic record of the operation and status without recording the raw key, account password or full request secrets.
Return a message the walker can act on. A service-key error calls for operator attention, a low balance calls for an account decision, and a rate limit calls for restraint. Repeatedly retrying a 401 or 402 does not fix the cause. For a request whose response was lost, record that uncertainty rather than assuming either a free failure or a confirmed success.
Replace the key without losing track of deployments
Signup displays the full key once, before payment. Later account views show the prefix, not a recoverable copy. A signed-in operator can confirm the account password and regenerate the key; the old key becomes invalid immediately. Prepare the list of backend environments that need the replacement, then update them deliberately. There is no promise that changing one secret store automatically updates every running process.
Retain the password securely: the current service has no password-reset flow or Google login. After replacement, use a deliberate request to check the deployment you changed, remembering that a successful retrieval is charged. Keep the app’s loading and error messages honest during the change. Return to /en/#field-notes for the related state-design and budgeting notes.
