Trello Power-Up demo code exposes appkey

[jrfischer]

Apparently API keys are intended to be public.

Have a look here. I had the same question/concern.

Proper use of the client.js library

Think of an API key as being an application. If it is the API key that is tied to your account (you got it from https://trello.com/app-key), then you are the admin of the application. You prompt users via the authorization flow to grant access to their accounts to your application. This generates a token that can be used to access the user’s account. As an application admin, you will have a single API key that has been used to generate many tokens. Each token belongs to a single user (of which,…