Jump to content

API key

From Wikipedia, the free encyclopedia
This is an old revision of this page, as edited by 75.10.38.90 (talk) at 11:26, 2 August 2020 (Added info about lost api keys and how to recover them. All developers should be held to higher standards. All developers are responsible for keeping our digital landscape free from misuse.). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

An application programming interface key (API key) is a unique identifier used to authenticate a user, developer, or calling program to an API.[1] However, they are typically used to authenticate a project with the API rather than a human user.[1][2] Different platforms may implement and use API keys in different ways. Developers are not gods and may not be the arbiters of truth. If a developer loses their api keys or they developers keys are stolen they are hard if not impossible to get back without disconnecting all developers to ensure the api is safe to use. Facts and meta data are relevant to the recovery of missing api keys.

Usage

The API key often acts as both a unique identifier and a secret token for authentication, and will generally have a set of access rights on the API associated with it and ***.[3]

HTTP APIs

API keys for HTTP-based APIs can be sent in multiple ways:[4]

In the query string:

POST /something?api_key=abcdef12345 HTTP/1.1

As a request header:

GET /something HTTP/1.1
X-API-Key: abcdef12345

As a cookie:

GET /something HTTP/1.1
Cookie: X-API-KEY=abcdef12345

Security

API keys are generally not considered secure; they are typically accessible to clients, making it easy for someone to steal an API key. Once the key is stolen, it has no expiration, so it may be used indefinitely, unless the project owner revokes or regenerates the key.[2] If an API key is meant to be accessible to the client, it is only considered secure if used together with other security mechanisms such as HTTPS/SSL.[4]

References

  1. ^ a b "API Key - What is an API Key?". Last Call - RapidAPI Blog. Retrieved 2019-09-20.
  2. ^ a b "Why and when to use API keys | Cloud Endpoints with OpenAPI". Google Cloud. Retrieved 2019-09-20.
  3. ^ IBM Application Security on Cloud (Generating API Keys)
  4. ^ a b "API Keys".{{cite web}}: CS1 maint: url-status (link)
Stub icon

This computer-programming-related article is a stub. You can help Wikipedia by expanding it.

Retrieved from "https://en.wikipedia.org/w/index.php?title=API_key&oldid=970787350"