Quick question about Web SDK

It is good to put all my js code created with web sdk to file e.g index.php wich is visible for all site viewers

It is generally not recommended to include all your code, especially sensitive SDK credentials, in a file that is visible to all site viewers. Doing so can expose your Appwrite API keys or other sensitive information, making it vulnerable to potential security risks.

That is why I personally recommend working with env variables and different code files.

Ok so make env file that is not readable to other but for js is

ye or just separate your files. you would also need to think if everyone can access your code (if it's open source), how you can hide the important stuff which shouldn't be shared

Oh and I have one more question

I can do oauth2 via web sdk

https://appwrite.io/docs/client/account?sdk=web-default#accountCreateOAuth2Session