Hi Nas,

I suppose that you can make use of Enable API for Internal Use? 
>> Navigate to APP composer > API Builder > Settings
>>>>Settings > All properties > Advanced Settings 
-------You can see the Enable API for Internal Use? 

That way , the API that is displayed can't be called externally.
It can be used for internal Purpose only.
Hence, making the api_id and api_key exposed inside the console unusable by external party. 



May this help you in resolving your concern.
Thanks!

Hi John Smith ,

Thanks for the suggestions. Based on your response, I suppose using the Enable API for Internal Use feature would resolve the concern of the stated security issue. I have checked the documentation accessible at https://dev.joget.org/community/x/BgITAw , a snapshot is shown as below.

However, I have some concerns that require clarification after enabling this feature. As the API key and API id would still be exposed, and moreover, can be seen in the console, is there any way to test the API externally to ensure the API is unusable as expected? Kindly advice.

Thanks.

Following up to the previous comment, I have tested the API through Postman, and yes, the API is not usable externally, as expected.