Why leak the key?

[mattpilott]

Why do you leak the access token here?

https://github.com/roberto-butti/my-storyblok-sveltekit-example/blob/main/src/storyblok.js

[roberto-butti]

Hi, good question.
The token here is a public token. It is not a personal access token.
And this function is a "multi-purpose" function that you can use in the client and server sides.

But if you want to "protect" your access token and you are building a server-side-only project, using the .server files, you can rename the env variable from PUBLIC_ to SECRET_ for example:

import { SECRET_ACCESS_TOKEN } from '$env/static/private'

Another thing to evaluate is using static or dynamic in the import statement.

A nice article: https://joyofcode.xyz/sveltekit-environment-variables#static-for-variables-during-the-build-process

Did I understand your question correctly?