These practices apply regardless of the exact authentication mechanism 20dragons uses.
Never expose secret tokens in public JavaScript
Do not put an API token directly in client-side JavaScript that runs in a browser. Anyone viewing the page can read it.
Do not commit tokens to version control
Keep tokens out of Git repositories, including private ones. Once a secret is committed, treat it as compromised even if you remove it later, since it may still exist in the repository's history.
Use environment variables
Store tokens in environment variables or a secrets manager, not directly in your source code.
Revoke compromised tokens
If you believe a token has been exposed, revoke or replace it as soon as possible. See API authentication once the revoke/replace process is confirmed.
Use HTTPS
Always call the API over HTTPS, never plain HTTP, so your token and data are not exposed in transit.
Do not log secrets
Avoid writing tokens to logs, error messages, or crash reports.