The answer
Because hardcoding http://localhost:5000 means production calls the wrong backend. Use environment variables for the API URL so each environment, development, production, uses the right value.
Common Full Stack Setup Mistakes in React + Node Projects
Why should I not hardcode the API URL in a React app?
More FAQs in Common Full Stack Setup Mistakes in React + Node Projects
Configure CORS on the backend to allow the frontend's origin in development. In production, serve both from the same origin to avoid CORS entirely, or configure the backend to allow the production frontend domain.
Because putting it in client-side code exposes it to anyone. The JWT secret must stay on the backend, loaded from environment variables. The frontend only stores the token the backend issues, never the secret.
Because without it, unauthenticated users can access protected endpoints. Apply JWT middleware to every protected endpoint so the backend verifies the token before allowing access.
Still have questions?
Browse all our FAQs or reach out to our support team
Want to upskill yourself?
Your learning library
Small steps. Big possibilities.
Find your next course. Build something great.