API key
 | This article needs additional citations for verification. (October 2018) |
An application programming interface (API) key is a unique identifier used to authenticate and authorize a user, developer, or calling program to an API.[1]
Cloud computing providers such as Google Cloud Platform and Amazon Web Services recommend that API keys only be used to authenticate projects, rather than human users.[2][3]
Usage
HTTP APIs
API keys for HTTP-based APIs can be sent in multiple ways:[4]
In the query string:
POST /something?api_key=abcdef12345 HTTP/1.1
As a request header:
GET /something HTTP/1.1
X-API-Key: abcdef12345
As a cookie:
GET /something HTTP/1.1
Cookie: X-API-KEY=abcdef12345
Security
API keys are generally not considered secure; they are typically accessible to clients, making it easy for someone to steal an API key. Keys often have no expiration, meaning a stolen key can be used indefinitely unless revoked or regenerated.[5] Keys are supposed to be a secret known only by the client and server, so they should not be communicated over an insecure channel and can only be considered secure when used in conjunction with other security mechanisms such as HTTPS.[4]
Incidents
In 2017, Fallible, a Delaware-based security firm examined 16,000 Android apps and identified over 300 which contained hard-coded API keys for services like Dropbox, Twitter, and Slack.[6] While some of these keys were harmless, many were meant to be kept secret and had inappropriate privilege levels.[7]
References
- ^ "API Key - What is an API Key?". Last Call - RapidAPI Blog. Retrieved 2019-09-20.
- ^ "What is an API Key? - API Keys and Tokens Explained - AWS". Amazon Web Services, Inc. Retrieved 2024-09-01.
- ^ "Why and when to use API keys | Cloud Endpoints with OpenAPI". Google Cloud. Retrieved 2024-09-01.
- ^ a b "API Keys". Archived from the original on 2019-10-17.
- ^ "Why and when to use API keys | Cloud Endpoints with OpenAPI". Google Cloud. Retrieved 2019-09-20.
- ^ "Hundreds of popular Android apps contain hard-coded secret keys". ZDNet. Retrieved 2022-06-20.
- ^ "We reverse engineered 16k apps, here's what we found | HackerNoon". hackernoon.com. Retrieved 2023-04-03.
Book sources
- De, Brajesh (2017). API management: an architect's guide to developing and managing APIs for your organization (1st ed.). New York: Apress. ISBN 978-1-4842-1305-6. OCLC 978273106.
External links
 | This computer-programming-related article is a stub. You can help Wikipedia by expanding it. |