How I protect Discord webhook URLs from being exposed in frontend code

The Problem If you've ever used Discord webhooks in a frontend app, you've probably done something like this: const webhookUrl = "https://discord.com/api/webhooks/123456/abc..." fetch(webhookUrl, { method: "POST", body: JSON.stringify(message) }) The problem: that URL is now visible to anyone who opens DevTools. The pattern that actually works: Register your webhook URL once through a secure backend Get back a safe ID (like whk_abc123) Use only that ID in your frontend — the real URL never leave