Framework guide: protect the API key
Angular is a frontend framework: all your application code is downloaded and executed in the user’s browser. Any value included in the bundle — including a API key set to constant orenvironment.ts — is visible to anyone who opens the developer tools or inspects network traffic.
Arquitectura recomendada
MarkpdfService is configured with baseUrl pointing to your backend, not the public API:
app.config.ts
Proxy backend example (Express + @markpdf/sdk)
server/routes/markpdf.ts
/api/markpdf/convert, your Express backend calls the actual API. The browser never sees YOUR_API_KEY.
Configure MarkpdfService to talk to your backend
app.config.ts
MarkpdfService internally constructs normal HttpClient requests — you can combine it with your app’s own auth interceptors (JWT, session cookies) just like any other Angular HTTP service.
Error interceptor
app.config.ts
markpdfErrorInterceptor normalizes error responses from your backend (provided you forward the status and body { error: string } as in the Express example above) to instances of MarkpdfClientError, consistent with those documented by Error Handling.
Authenticate the end user against your backend
MarkpdfService does not manage user sessions — that is the responsibility of your own app. Combine it with your usual auth interceptor:
app.config.ts
