Why do we have to provide private keys in eosjs?

Question

Eosjs takes a parametre in its config viz. keyProvide where we have to pass the private keys.

Eos = require('eosjs')

// Private key or keys (array) provided statically or by way of a function.
// For multiple keys, the get_required_keys API is used (more on that below).
keyProvider: '5KQwrPbwdL6PhXujxW37FSSQZ1JiwsST4cqQzDeyXtP79zkvFD3'

// Localhost Testnet (run ./docker/up.sh)
eos = Eos({keyProvider})

But if we deploy that code to the production, aren't we exposing our private keys? Or I am misunderstanding the concept here. Please clear the confusion.

Answer 1

EOS is very new, things are changing rapidly. Currently the easiest and best way to keep the private keys private is to use a different tool to handle signing of transactions.

The easiest and most popular is Scatter. Here are the documentations for it.

The user stores his keys in Scatter and there is a suite of functions to interact with it from within your client side code.