API_KEY_ID is most likely used in your front-end code, which may be exposed. To only allow your website or app to use your API key, you can set the Allowed Origins under Settings tab in the Dashboard.
This will do 2 things:
Cotter's JS SDK will only load if the parent is listed.
If you pass in
RedirectURL parameter, the JS SDK will only allow it if it's listed.
You will always need to specify a RedirectURL when using Cotter's Email or Phone Number verification. The RedirectURL is the deep-link to your app that is used by the in-app browser to redirect back to your app. You need to add this redirect URL in the list.
Make sure you follow the syntax below:
<scheme> "://" <hostname> [ ":" <port> ]
To allow any parent and any RedirectURL: specify
* in the input.