I'm building an API that handles users clicking on submit/delete requests to join a sports club. When a request is created/deleted I need the club's PK in order to find the instance of the club (when the ClubRequest instance is created) or the request (when the request for the specific club is deleted).

Model of request

class ClubRequest(models.Model):
 athlete = models.ForeignKey(User, [...])
 timestamp = models.DateTimeField(auto_now_add = True)
 club = models.ForeignKey(Club,[...])

I fetch a list of all instances of the clubs, then create EventListeners that have one of the parameters the PK of the clubs. The client should receive an encrypted PK.

for (club in list) {
        res = list[club];
        name = res["name"]
        id = res["id"]
        
        createDivs(requested, id)
       
        document.querySelector("#search-name").onclick = null
}

Function that handles submitting/deleting requests

if (new_request == "true") {
    fetch("createRequest", {
        method: "POST",
        body: JSON.stringify({
            "id": club_id
        })
    })
    .then(response => response.json())
    .then(result => {

        changeIcons(self, new_or_old)
        self.classList = "button is-info"
        self.setAttribute("new_or_old", false)
   
    })
} else {
    fetch("undoRequest", {
        method: "POST",
        body: JSON.stringify({
            "id": club_id
        })
    })
    .then(response => response.json())
    .then(result => {
        
        changeIcons(self, new_or_old)
        self.classList = "button is-primary"
        self.setAttribute("new_or_old", true)
       
    })
}

Should I use a public/private key system or is there a better way to do this?