How to secure when make a call to DialogFlow from Client side (browser)?

Question

Where to save security information when I want to send a Web API call to DialogFlow from Browser? I use Angular.

I have a backend of the application, but I don't want to send the request through my backend (don't want to pay for the additional traffic).

Is it even possible to make a secure call from a browser?

Are there any techniques I could apply to achieve this? As I know DialogFlow uses Google Cloud (GCP) behind the scene, are there any recommendations from GCP (so far can't find any)?

Answer 1

Anything sensitive you need to store client side is out of your control, and therefore you need to assume it will be compromised.

If the API can be called from your server instead of the browser then you can store the token on the server to protect it, but this depends on what the API is used for.

It appears their documentation on accessing the API can be found here: https://dialogflow.com/docs/reference/v2-auth-setup#getting_the_service_account_key