# Do user inputs on a public notebook ever touch Observable's servers? **URL:** \ **Category:** Help\ **Created:** [March 24, 2021, 2:18am UTC](https://talk.observablehq.com/t/do-user-inputs-on-a-public-notebook-ever-touch-observables-servers/4816 "2021-03-24T02:18:19Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![mgerring](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/mgerring/32/4715_2.png) [@mgerring](https://talk.observablehq.com/u/mgerring)\ **Post date:** [March 24, 2021, 2:18am UTC](https://talk.observablehq.com/t/do-user-inputs-on-a-public-notebook-ever-touch-observables-servers/4816/1 "2021-03-24T02:18:19Z")
This might be a stupid question, but — I’m using Observable for code examples for a company with a private API, to show customers how to use our API data to do various things. Since you can’t use Secrets in a shared notebook, and since hardcoding credentials is obviously a bad idea, I settled on using Inputs to ask for API credentials, since those don’t appear to be saved with the notebook, only run on the client side. That allows a customer to change some inputs to our API and provide their own credentials, and then run our code examples with live feedback. Is that a good idea? My gut tells me it isn’t, but I can’t think of a better way to do it at the moment. Especially not one that easily allows customers to provide their own API credentials in a secure(ish) way. ---
**Author:** ![asg017](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/asg017/32/2159_2.png) [@asg017](https://talk.observablehq.com/u/asg017)\ **Post date:** [March 24, 2021, 4:45am UTC](https://talk.observablehq.com/t/do-user-inputs-on-a-public-notebook-ever-touch-observables-servers/4816/2 "2021-03-24T04:45:03Z")
It _should_ be ok: afaik, the values of specific HTML inputs aren’t captured/logged by Observable. So if you have something like ```javascript viewof token = html`` ``` And every reader to that notebook pastes in their own secret, then that secret shouldn’t be stored in Observable database (as far as I know), and it will only be kept in the reader’s page session. But if this is actually 100% secure™, I’d love to hear other people’s thoughts on this. Because if you’re going to be given the secrets to every reader in plaintext via some other method, that might be introduce more complexity/more room to make a mistake. It’s also possible that you are using a malicious 3rd party JS library that query for `input[type=password]` elements and sends those values to some shady remote server, but if you’re using well-used libraries like `d3` and all I seriously doubt that would be an issue. See also [Encrypted Message](https://observablehq.com/@mbostock/encrypted-message) for a potentially more secure/easier to distribute option… Another option: Create a team, add yourself as an editor, make a private team notebook with a `Secret`. Then, add other people as “readers” (should be free), who can access the private team notebook and view the contents of the notebook/secret securely. It would be $7 a month for you, but much easier than juggling around secrets off-platform imo. ---
**Author:** ![tomlarkworthy](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/tomlarkworthy/32/5940_2.png) [@tomlarkworthy](https://talk.observablehq.com/u/tomlarkworthy)\ **Post date:** [March 26, 2021, 9:41am UTC](https://talk.observablehq.com/t/do-user-inputs-on-a-public-notebook-ever-touch-observables-servers/4816/3 "2021-03-26T09:41:11Z")
I checked the network, your typing do not leave the environment. It is perfectly fine to do it like that. Observable has corporate customers who would blow their top if anything like that happened. So I feel comfortable pasting service accounts in my Google API client playground. > **[Google API Client](https://observablehq.com/@tomlarkworthy/gapi)** > > Lets try and make the Google APIs easier to use in Observable. Feedback welcome (use the burger menu to the left to 'Add Comment'). Autocomplete! If you correctly setup a discovery doc, autocomplete on observable works! Press TAB on the client object... If you want to hardcode credentials take a look at > **[How to password protect a Notebook secret](https://observablehq.com/@endpointservices/notebook-secret)** > > I sometimes wish to hide a secret in a public notebook, for example, a service account to run billable cloud commands. This notebook provides functionality to generate a password-protected encrypted payload, which is safe to save in a public... With a full example now here: > **[How to cache BigQuery results in a public Notebook with Firebase Storage](https://observablehq.com/@endpointservices/cache-bigquery)** > > BigQuery is powerful, but expensive if misused, so you never want to grant BigQuery API access to the public. For dataviz, a cache of BigQuery data is preferred. But in the ObservableHQ world, we want to be transparent about how we prepared our... ---
**Author:** ![tophtucker](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/tophtucker/32/4781_2.png) [@tophtucker](https://talk.observablehq.com/u/tophtucker)\ **Post date:** [March 26, 2021, 4:14pm UTC](https://talk.observablehq.com/t/do-user-inputs-on-a-public-notebook-ever-touch-observables-servers/4816/4 "2021-03-26T16:14:41Z")
Alexander and Tom have already given great answers, but I want to confirm from the Observable side that we do not log or save anything you put into Inputs. “What gets sent to Observable and what doesn’t” comes up a lot, and we’d love to figure out how to make it clearer within the product. The big distinction is that the contents of the gray-background code editor are saved to Observable servers, and the white-background page (the output of that code) runs entirely on the user’s computer. Here’s my rough attempt at a diagram: ![Frame 1 (12)](https://canada1.discourse-cdn.com/flex030/uploads/observablehq/original/2X/3/3be8c85f795d51e332887f6dc95f486b9382c8a9.png) As for your specific use case, Tom has been doing a ton of interesting work in that area, so there may be no better answer than his! [Here’s an example](https://next.observablehq.com/@observablehq/self-hosted-database-proxies) where our coworker Visnu includes a utility (to convert a username/password to a database connection URL) that only runs locally in the user’s browser, with the explicit caveat: “You should be wary of any form on the internet prompting you for a password! Feel free to inspect this code to ensure nothing nefarious is happening.” I’m no security expert, so here I have to balance my excitement about the possibilities of the notebook medium against the generally prudential advice not to ask users to enter credentials anywhere other than a single clear secure sanctioned login page. Is it a read-only API? Are all the calls idempotent? Could fiddling with a cell (in the playful mindset of someone exploring docs and examples) potentially do something destructive? Would the user understand that if they loaded more code on the page (e.g. adding a cell requiring a library), it could potentially access their credentials? Would they be able to distinguish a safe notebook from a malicious one? Without knowing your API, I guess my advice is probably to include mock responses (e.g. from a file attachment or loaded from a static JSON somewhere) so that readers can explore the real syntax and schemas in a safe, harmless, playful sandbox.