# decryption for fetch before W3C calls

**URL:** <https://es.discourse.group/t/decryption-for-fetch-before-w3c-calls/1503>\
**Category:** 💡 Ideas\
**Tags:** proposal\
**Created:** [November 6, 2022, 8:55pm UTC](https://es.discourse.group/t/decryption-for-fetch-before-w3c-calls/1503 "2022-11-06T20:55:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nick](https://yyz2.discourse-cdn.com/free1/user_avatar/es.discourse.group/nick/32/1555_2.png) [@nick](https://es.discourse.group/u/nick)\
**Post date:** [November 6, 2022, 8:55pm UTC](https://es.discourse.group/t/decryption-for-fetch-before-w3c-calls/1503/1 "2022-11-06T20:55:43Z")

</div>

Any API must _have it's caller with **authorization bearer credentials** decrypted **outside of the scope of the client** , and cannot be even sent the results of an encrypting/decrypting service_ (to protect the API user from theft).

If a private decryption method can hide the result from the public client caller (function), wouldn't a nice proposal be to have a new global method that [decrypts for the Authorization headers](https://docs.snipcart.com/v3/api-reference/authentication#credentials-format) of a [W3C fetch request](https://stackoverflow.com/questions/44058726/is-the-fetch-api-an-ecmascript-feature)? This way we can have logic on the client (_cloudflare edge_ [service worker tokenize](https://github.com/NickCarducci/snipcart-worker), no redirect nor _digital ocean_ second `POST` needed perhaps just `GET` from such a service hosting an API key to be [held privately](https://support.snipcart.com/t/hiding-api-keys/325/4?u=nmc123)). [Here](https://developer.mastercard.com/mdes-digital-enablement/documentation/api-reference/), the service decrypts instead of the potential new private caller, but encryption of the Authorization header can be _called by a method that is private from the client_ AND the `Network tab in Chrome devtools inspect`, perhaps only when finally sending to HTTP _(as I imagine the code the data populating devtools happens within the block before `return`)_.

---

<div class="post-metadata">

**Author:** ![ljharb](https://yyz2.discourse-cdn.com/free1/user_avatar/es.discourse.group/ljharb/32/8_2.png) [@ljharb](https://es.discourse.group/u/ljharb)\
**Post date:** [November 7, 2022, 4:56am UTC](https://es.discourse.group/t/decryption-for-fetch-before-w3c-calls/1503/2 "2022-11-07T04:56:47Z")

</div>

This discourse is for the JS language - fetch is specified in HTML.