# Does runtime.http\_key if put in the client app allow to make admin-only requests?
**URL:** https://forum.heroiclabs.com/t/does-runtime-http-key-if-put-in-the-client-app-allow-to-make-admin-only-requests/4860
**Category:** Client Libraries
**Created:** [January 10, 2024, 8:53pm UTC](https://forum.heroiclabs.com/t/does-runtime-http-key-if-put-in-the-client-app-allow-to-make-admin-only-requests/4860 "2024-01-10T20:53:33Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@RickCastle2018](https://forum.heroiclabs.com/u/RickCastle2018)
#### Post date: [January 10, 2024, 8:53pm UTC](https://forum.heroiclabs.com/t/does-runtime-http-key-if-put-in-the-client-app-allow-to-make-admin-only-requests/4860/1 "2024-01-10T20:53:33Z")
Hi! I was wondering if runtime.http\_key may be put in the client app and how should we authenticate admins when developing an additional admin panel for our (common for all of our games) go module. I was thinking about using the JS lib and allowing our go-rpc admin methods to be available for certain usernames only. Maybe there is a better solution around?
---
### Author:  [@RickCastle2018](https://forum.heroiclabs.com/u/RickCastle2018)
#### Post date: [January 19, 2024, 10:00am UTC](https://forum.heroiclabs.com/t/does-runtime-http-key-if-put-in-the-client-app-allow-to-make-admin-only-requests/4860/2 "2024-01-19T10:00:35Z")
One another related question that arises is is there any anti-spam protection for account registrations or any other abuse protection built-in? Or should we implement it ourselves?
---
### Author:  [@ftkg](https://forum.heroiclabs.com/u/ftkg)
#### Post date: [January 24, 2024, 7:19pm UTC](https://forum.heroiclabs.com/t/does-runtime-http-key-if-put-in-the-client-app-allow-to-make-admin-only-requests/4860/3 "2024-01-24T19:19:19Z")
Hi, it’s not advisable to expose the `HTTP key` directly in a client app due to security reasons as it could easily get compromised. A safer practice is to host it on the server and proxy it along the request to your admin server-to-server Nakama RPCs that would provide your custom functionality.
The Console Authenticate API has rate limiting on login attempts, and will lockout accounts that exceed the max number of attempts for a certain period.