Best way to store env variables in figma plugin (building figma plugin)

One more thing I want to know, Is main thread code inspectable using dev tools? if so is it safe to store sensitive variables?

Never store sensitive information in the plugin code. You should have your own backend or use external services.

Hey ​@tank666 ,

Thanks for replying, I have my own backend but I have made the services authorized, if Authorization is not passed in any backend service, it will not work (401 unauthorized).
I am using supabase client authorization (supabase auth) which requires supabase_url and supbase_anon_key (sensitive vars)

I cannot store them in backend for 2 reason (if i fetch variables from backend) -

• my services are secure currently, I don’t want to allow any api without authorization header.
• if I fetch these variables in frontend, it can be intercepted using dev tools.

If you have used any client in figma plugin how have you managed the secrets and user token?

Supabase anon key is safe to expose if I remember well, but requires RLS in the db to limit operations .if you dont use RLS then anon key became sensitive and should not be exposed .