Skip to content

API Key

An API key is a credential used by software to identify or authenticate an application making requests to an API.

An API key is a credential used by software to identify or authenticate an application making requests to an API.

It is commonly represented as a long unique string.

What It Means in Practice

An integration might send:

API-Key: abc123...

with each request.

The API can then associate the request with a particular application, project, customer, or account.

Depending on the service, the key may also determine:

API Key vs. Password

An API key is used by software rather than entered interactively by a person.

It should still be treated as a credential when possession of the key grants privileged access.

A secret server-side key should not be published in:

  • Git repositories
  • Frontend JavaScript
  • Documentation
  • Screenshots
  • Public configuration files

Google's current API security guidance recommends storing server-side API keys outside source code and applying API and application restrictions. Google API-key security guidance

API Key vs. OAuth

An API key often identifies the calling application or project.

OAuth is designed for delegated authorization, where one application receives limited access to another service on behalf of a user or account.

For example:

API key

This request comes from MRC's application.

OAuth

The user has authorized MRC's application to access these specific resources.

The exact behaviour depends on the provider.

Why It Matters

API keys are often simple to implement.

That simplicity can make them appropriate for certain server-to-server integrations, public-data services, or usage identification.

But a leaked unrestricted key can create:

  • Unauthorized access
  • Unexpected usage
  • Financial cost
  • Rate-limit exhaustion

Common Problems

Common problems include:

  • Keys committed to GitHub
  • One key shared across every environment
  • No restrictions
  • Keys belonging to former developers
  • Production secrets copied into local files
  • Keys never rotated
  • Treating any API key as safe to expose publicly

How to Improve

Follow the provider's security model.

Where supported:

  • Restrict the key
  • Separate development and production
  • Store secrets outside source code
  • Document ownership
  • Rotate compromised credentials
  • Monitor usage