Domain Whitelisting vs. Secret Tokens for API Request Security

When implementing Mapbox services, developers must choose between utilizing public access tokens restricted by URL whitelisting or utilizing secret tokens stored on a backend server to proxy requests.

Public tokens are designed for client-side integration, but their visibility in the browser's network tab necessitates the use of domain restrictions to prevent unauthorized third-party usage. Conversely, secret tokens offer higher privilege levels and complete invisibility to the end-user, but they introduce the architectural overhead of a server-side proxy for all map-related API calls.

For an application requiring strict quota management and protection against token theft, the trade-off involves balancing client-side performance against server-side security controls.

• Does domain whitelisting provide sufficient protection against sophisticated request spoofing for public tokens?
• At what scale of request volume does the latency of a secret token proxy outweigh the security benefits?