# Auth Bearer Token Stored in Netlify Environment Variables is Exposed

**URL:** <https://answers.netlify.com/t/auth-bearer-token-stored-in-netlify-environment-variables-is-exposed/44084>\
**Category:** Support\
**Tags:** security, environment-vars, netlify-newbie\
**Created:** [September 13, 2021, 6:13pm UTC](https://answers.netlify.com/t/auth-bearer-token-stored-in-netlify-environment-variables-is-exposed/44084 "2021-09-13T18:13:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ives99](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/ives99/32/29433_2.png) [@ives99](https://answers.netlify.com/u/ives99)\
**Post date:** [September 13, 2021, 6:13pm UTC](https://answers.netlify.com/t/auth-bearer-token-stored-in-netlify-environment-variables-is-exposed/44084/1 "2021-09-13T18:13:15Z")

</div>

I’ve stored API keys in the .env file for my create-react-app and ensured the .env file is included in gitignore so as not to expose them on GitHub. I then added the environment variables to the Build & Deploy settings for my site on Netlify. However, it appears the bearer token of the GET request from my react app is still exposed in Chrome Dev Tools even though the jsx file uses the proper process.env.REACT\_APP format.

I’m fairly new to Netlify and React in general. What am I missing?

---

<div class="post-metadata">

**Author:** ![hillary](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/hillary/32/21132_2.png) [@hillary](https://answers.netlify.com/u/hillary)\
**Post date:** [September 14, 2021, 9:02pm UTC](https://answers.netlify.com/t/auth-bearer-token-stored-in-netlify-environment-variables-is-exposed/44084/3 "2021-09-14T21:02:13Z")

</div>

Hey there, @ives99 👋

Welcome to the Netlify Forums and thanks for reaching out!

I believe that that REACT\_APP\_\* are intentionally made visible in the client-side code. You can read about this further in the React Docs, which I will link below:

> **[Adding Custom Environment Variables | Create React App](https://create-react-app.dev/docs/adding-custom-environment-variables/#referencing-environment-variables-in-the-html)**
>
> Note: this feature is available with react-scripts@0.2.3 and higher.

Let us know if this helps!