API Authentication Guide
Understand authentication patterns for video player APIs, public iframe embeds, private keys, and backend proxying.
Developer intent
Choose the right authentication model for public embeds, private dashboards, and server-side API calls.
Public embeds
Iframe embeds can be public when they do not expose private user data.
Backend keys
Private provider keys should stay on your backend and never be placed in browser code.
Future-proofing
If you add private analytics or dashboards, protect those routes with account authentication.
Example
// Public player embed
<iframe src="https://www.vidcore.org/embed/movie/27205" />
// Private keys belong server-side only
process.env.TMDB_API_KEY