How to programmatically send tokens using EOSJS safely?

Question

According to the EOSJS readme:

Using the JsSignatureProvider in the browser is not secure and should only be used for development purposes. Use a secure vault outside of the context of the webpage to ensure security when signing transactions in production

const defaultPrivateKey =
"5JtUScZK2XEp3g9gh7F8bwtPTRAkASmNrrftmx4AxDKD5K4zDnr"; // bob const
signatureProvider = new JsSignatureProvider([defaultPrivateKey]); 

According to this description, JsSignatureProvider is not safe to use in combination with .env variables. What is the safe way to programmatically send EOSIO tokens using EOSJS?

Answer 1

transact() with the flag sign: false returns serializedTransaction binary. You can sign it with independant and safer way you make. For example, make separated signing server which accepts binary and returns it with signature, but not possible to access from outside of your private network.

Answer 2

Check out this article about eosjs and scatter, I think that it has good explanation about signing transactions without exposing your keys using scatter. To be honest, I have never used it but I am planning to.

https://medium.com/coinmonks/dapp-development-on-eos-blockchain-using-eosjs-and-scatter-557f1b5b65d0