Sharing your key seems like the most 90s approach to system design.
"Only you and the search engines should know the key.. so obviously, we want you to host it in plain text, in the root directory."
"Only you and the search engines should know the key.. so obviously, we want you to host it in plain text, in the root directory."
it is however much easier to serve static content than evaluating headers. the benefit of significantly increased compatibility in how you can serve the content probably outweighs the risk of logging the secret in many cases, as static content serving is compatible with virtually anything, adding additional logic to be evaluated at runtime through other means than URL contents is not as widely supported.