# \[Archive\] \[closed\] Securing Private Keys in Web3Auth: Preventing Malicious Code in Frontend

**URL:** <https://builder.metamask.io/t/archive-closed-securing-private-keys-in-web3auth-preventing-malicious-code-in-frontend/1198>\
**Category:** Embedded Wallets (Web3Auth)\
**Created:** [October 21, 2024, 9:38am UTC](https://builder.metamask.io/t/archive-closed-securing-private-keys-in-web3auth-preventing-malicious-code-in-frontend/1198 "2024-10-21T09:38:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![benoit.marcot](https://avatars.discourse-cdn.com/v4/letter/b/4491bb/32.png) [@benoit.marcot](https://builder.metamask.io/u/benoit.marcot)\
**Post date:** [October 21, 2024, 9:38am UTC](https://builder.metamask.io/t/archive-closed-securing-private-keys-in-web3auth-preventing-malicious-code-in-frontend/1198/1 "2024-10-21T09:38:29Z")

</div>

> **🏛 Archived Content from Web3Auth Community**
> 
> This topic was originally posted by **benoit.marcot** on 10/21/2024.  
> This content has been migrated from our previous community forum to preserve valuable discussions.

* * *

Here’s a rephrased version of your message:

Hi! I am currently working with the Web3Auth quickstart example from the [Auth0 guide](https://web3auth.io/docs/guides/auth0#using-the-web3auth-plug-and-play-no-modal-sdk). I have concerns about the potential risks of a frontend developer on my team inserting malicious code that could call “eth\_private\_key” and transmit it externally, potentially exposing our users’ private keys. Is this a realistic threat? Is there a way to prevent calls to “eth\_private\_key” and have the signing done on Web3Auth’s side instead of locally on the user’s device? What are the best practices for securing this?

---

<div class="post-metadata">

**Author:** ![w3abot](https://avatars.discourse-cdn.com/v4/letter/w/4da419/32.png) [@w3abot](https://builder.metamask.io/u/w3abot)\
**Post date:** [October 21, 2024, 9:40am UTC](https://builder.metamask.io/t/archive-closed-securing-private-keys-in-web3auth-preventing-malicious-code-in-frontend/1198/2 "2024-10-21T09:40:40Z")

</div>

Hi Benoit! Thank you for reaching out with your concerns regarding the security of private keys while using Web3Auth.

From your message, I see that you are working with the Web3Auth quickstart example based on the Auth0 guide. Here are some key points we can gather for the support team:

- **SDK Details** : Not specified
- **Platform** : Not specified (but you are following a web-based integration using the Auth0 guide)

Regarding your concerns about potential threats from frontend developers, it is important to remember that the security of keys and sensitive actions should ideally be handled server-side rather than client-side. Here are a few best practices you might consider:

1. **Limit Frontend Access** : Ensure that only trusted developers have access to sensitive areas of your codebase.
2. **Use Server-Side Signing** : You can try to implement signing on your server instead of the client side. This helps in preventing exposure of private keys.
3. **Code Reviews** : Conduct thorough code reviews to catch any potentially malicious or risky code contributions from your team.
4. **Monitoring and Alerts** : Implement monitoring for unusual transactions or access patterns that could indicate a compromised frontend.

For the specific question about preventing calls to `eth_private_key`, currently, Web3Auth handles key management in a secure manner, and signing can be performed through their SDK without having to expose keys in the frontend.

If you need more specific guidance, such as code snippets or further details, let me know how I can assist!

> Note: This response was generated by an AI bot and may require further verification. The Web3Auth support team has tracked this issue and will be responding as soon as possible.

---

<div class="post-metadata">

**Author:** ![benoit.marcot](https://avatars.discourse-cdn.com/v4/letter/b/4491bb/32.png) [@benoit.marcot](https://builder.metamask.io/u/benoit.marcot)\
**Post date:** [October 22, 2024, 7:10am UTC](https://builder.metamask.io/t/archive-closed-securing-private-keys-in-web3auth-preventing-malicious-code-in-frontend/1198/3 "2024-10-22T07:10:28Z")

</div>

It has been replied in the Office Hours; there is an addon in the dashboard to disable the export of private key.