Private & Public env variables

[IgnusG]

I'm trying out refine and I extracted my secrets into an .env.local file without the public prefix NEXT_PUBLIC_ and I cannot seem to get the Airtable Provider working. I was forced to attach the public prefix which obviously exposes the key to the public. Is there a way to limit this?

[omeraplak]

Airtable data provider works on the client-side. That's why you should publish your env variables as Public.

https://nextjs.org/docs/basic-features/environment-variables

[IgnusG]

This should really be in the documentation. I wonder how many public access tokens with full rights are out there using the Airtable data provider. It might be silly (or obvious), but the default behaviour in Airtable is creating tokens with full rights so a junior developer could be one step away from giving away full access to the public.

[IgnusG]

Since it’s by design I solved it by adding a serverless function that refine can talk to. This function can perform auth and then call the original Airtable data provider from refine using tokens that are defined in private env variables.

[omeraplak]

Great, can you share a sample code? Maybe you can create an Airtable Guide for us!

[its-aye-lisa]

I'd be interested in this as well