Top Qs
Timeline
Chat
Perspective

API key

Identifier for authenticating with an API From Wikipedia, the free encyclopedia

Remove ads

An application programming interface (API) key is a secret unique identifier used to authenticate and authorize a user, developer, or calling program to an API.[1][2]

Cloud computing providers such as Google Cloud Platform and Amazon Web Services recommend that API keys only be used to authenticate projects, rather than human users.[3][4]

Remove ads

Usage

HTTP APIs

API keys for HTTP-based APIs can be sent in multiple ways:[5]

In the query string:

POST /something?api_key=abcdef12345 HTTP/1.1

As a request header:

GET /something HTTP/1.1
X-API-Key: abcdef12345

As a cookie:

GET /something HTTP/1.1
Cookie: X-API-KEY=abcdef12345

Security

API keys are generally not considered secure; they are typically accessible to clients, making it easy for someone to steal an API key. Keys often have no expiration, meaning a stolen key can be used indefinitely unless revoked or regenerated.[6] Keys are supposed to be a secret known only by the client and server, so they should not be communicated over an insecure channel and can only be considered secure when used in conjunction with other security mechanisms such as HTTPS.[5]

There are several risk scenarios when using API keys:

These risks generally stem from the key being in plaintext, which is potentially accessible to adversaries.[2]

Remove ads

Incidents

In 2017, Fallible, a Delaware-based security firm examined 16,000 Android apps and identified over 300 which contained hard-coded API keys for services like Dropbox, Twitter, and Slack.[7]

References

Loading content...
Loading content...
Loading related searches...

Wikiwand - on

Seamless Wikipedia browsing. On steroids.

Remove ads