Merge 70b914b into 09c26fa

Author: ryanio

README.md

@@ -29,6 +29,23 @@ Happy seafaring! ⛵️
 - [Frequently Asked Questions](developerDocs/faq.md)
 - [Contributing](developerDocs/contributing.md)
 
+### Security Warning
+
+**⚠️ Do not use this SDK directly in client-side/frontend applications.**
+
+The OpenSea SDK requires an API key for initialization. If you embed your API key in frontend code (e.g., browser applications, mobile apps), it will be publicly exposed and could be extracted by anyone, leading to potential abuse and rate limit issues.
+
+#### Recommended Architecture
+
+For frontend applications that need to interact with OpenSea functionality:
+
+1. **Create a backend API wrapper**: Set up your own backend server that securely stores your OpenSea API key
+2. **Call OpenSea SDK server-side**: Use opensea-js on your backend to interact with OpenSea's APIs
+3. **Return data to your frontend**: Send the necessary data (like transaction parameters) back to your frontend
+4. **Execute transactions in the browser**: Have users sign transactions with their own wallets (e.g., MetaMask) in the browser
+
+For a detailed example of this architecture, see [this guide on frontend fulfillment architecture](https://gist.github.com/ryanio/52b909dc36e50dd0c03983983ed5839b).
+
 ## Changelog
 
 The changelog for recent versions can be found at:

developerDocs/quick-start.md

@@ -52,3 +52,5 @@ const openseaSDK = new OpenSeaSDK(walletWithProvider, {
 ```
 
 In a browser with web3 or an extension like [MetaMask](https://metamask.io/) or [Coinbase Wallet](https://www.coinbase.com/wallet), you can use `window.ethereum` to access the native provider.
+
+> **⚠️ Security Warning**: While the SDK supports browser-based providers like `window.ethereum`, **you should never include your API key in client-side code**. Exposing your API key in frontend applications allows anyone to extract and abuse it. Instead, use the SDK on a secure backend server and return transaction data to your frontend. See the [README Security Warning](../README.md#security-warning) for the recommended architecture.