Search‑Only Key vs. Server‑Side Proxy: Which Limits Public Exposure Better?

Goal

Reduce accidental public exposure of Algolia API keys while maintaining functional client‑side search.

Constraints

• Search‑only keys can be embedded in browser code but still expose all searchable attributes.
• Private keys must be used server‑side; exposing them defeats their purpose.
• Key revocation propagates only after a brief delay, creating a short risk window.

Unresolved Decision

Should developers rely solely on Algolia’s documented key restrictions, or should they add a custom server‑side proxy that enforces stricter permissions and audit logging?

Questions

1. Is there a method to configure a search‑only key so that it excludes certain attributes from search results, thereby limiting data leakage?

2. Does implementing a server‑side proxy introduce measurable latency or maintenance overhead that outweighs the security benefits?

3. Can key revocation be guaranteed to be instantaneous across all clients, or is there always a brief window of exposure?