I would like to request a Leaflet tilelayer without exposing my API key and secret. For example, using the UrtheCast API (but would apply to other similar APIs that embed api_key and api_secret in the URL), I am provided a map tiles URL like the following:
https://tile-{s}.urthecast.com/v1/rgb/{z}/{x}/{y}?api_key=MY_API_KEY&api_secret=MY_API_SECRET&cloud_coverage_lte=20&acquired_gte=2016-02-26T08:00:00.000Z&acquired_lte=2016-04-27T06:59:59.999Z
I can then load the tiles in Leaflet like:
var layer = L.tileLayer('https://tile-{s}.urthecast.com/v1/rgb/{z}/{x}/{y}?api_key=MY_API_KEY&api_secret=MY_API_SECRET&cloud_coverage_lte=20&acquired_gte=2016-02-26T08:00:00.000Z&acquired_lte=2016-04-27T06:59:59.999Z').addTo(map);
But, anyone looking at my JavaScript code would know my api key and secret.
The docs give the following warning: All apps developed are encouraged to be used internally or via a proxy. Otherwise there is a risk of exposing your API key and secret.
How can I make a proxy (preferably using PHP) to make a hidden call for Leaflet map tiles?