Does anyone know what the safe and correct way to use the MedplumClient on the frontend? It looks like we need to use the medplum client id in order for us to use MedplumClient, but I assume medplum client id is a secret key that should be kept secure. I looked in the medplum app project and see that they have an .env file with MEDPLUM_CLIENT_ID=..., and later they import it with {clientId: import.meta.env?.MEDPLUM_CLIENT_ID} . Does anyone know if this is safe? I've never used import.meta.env?. before. We don't want any risk of secret keys getting exposed on the forntend react app. I figure someone would be able to inspect the webapp client view the source bundle file and search for the client id. I believe if they have access to the client id, they are then able to use that client id in their own app and potentially create users or use token exchange to access our medplum app api. (cc @rahul1 )

HI @khonlieu - the ClientID is not considered a secret. This is similar an "app id" in other systems. Your Client Secret is considered a secret, and should never exposed on the front end https://www.medplum.com/docs/auth/methods/client-credentials

I see. from my understanding, isn't the MedplumClient also able to create users? So if only the medplum client id is needed, and the client is also able to create users in the medplum app, wouldn't that also pose a security risk? That newly created user could potentially retrieve and view health data in the medplum api?

@khonlieu the MedplumClient doesn't automatically provide authorization to perform sensitive actions like creating users. I'll clarify below

Yeah, that makes sense. I was looking at the

react

project, in the

src/auth/NewUserForm.tsx

, there's a piece of code that says

await medplum.startNewUser({
              projectId: props.projectId,
              clientId: props.clientId,
              firstName: formData.firstName,
              lastName: formData.lastName,
              email: formData.email,
              password: formData.password,
              remember: formData.remember === 'true',
              recaptchaSiteKey,
              recaptchaToken,
            })

Initially I thought that was the only information required to create a new user using the medplum client. I'm guessing that creates a pending/"unconfirmed" user that has no access until they confirm they're account via an email link or something?

The main API call to invite a new user is to use the

/invite

endpoint: https://www.medplum.com/docs/auth/user-management-guide#invite-via-api