What is an API key?

To access a program or ap­plic­a­tion via an ap­plic­a­tion pro­gram­ming interface, you need an API key. API keys are one-time keys con­sist­ing of a secret string of char­ac­ters that au­thor­ises access. With a key, the API can recognise au­thor­ised users and protect programs and systems from un­au­thor­ised access.

What’s the defin­i­tion of an API key?

To connect and exchange func­tion­al­it­ies between two programs, ap­plic­a­tion pro­gram­ming in­ter­faces, better known as APIs, are used. An API lets pro­gram­mers, ap­plic­a­tions, apps, or projects interact with another service or program. In this way, an API can be used to control who’s allowed to make requests between APIs, who receives per­mis­sion, and which data formats are used.

Access is con­trolled by one-time and unique au­then­tic­a­tion keys called API keys. API keys can be requested from API operators, among others. If users or ap­plic­a­tions have the ap­pro­pri­ate key, the API server will grant you access.

How does an API key work?

API keys work similarly to passwords. As soon as an API ‘calls’ another API and requests access, access per­mis­sion is granted by ex­chan­ging the API key. The API key is assigned to the calling service or program and trans­mit­ted to the API server. If the API server confirms the au­then­ti­city of the API key, access to the program or certain func­tion­al­it­ies is granted. In addition, API keys can be used to perform actions across ap­plic­a­tions via the API in­ter­faces.

API operators define the access rights, data formats, and the scope of actions. In this way, it’s possible to determine exactly which type of users or projects receive access per­mis­sions and which actions are allowed via the pro­gram­ming in­ter­faces. API keys can also be anchored directly in pro­gram­ming languages like JavaS­cript or Python. Users or services can request the key in JavaS­cript from the as­so­ci­ated API server.

What are API keys used for?

API keys are mainly used in these areas:

• Iden­ti­fic­a­tion: An API key can identify ‘calling’ APIs, projects, or services to the API server. This makes it possible to log who requested or received access, and who was denied.
• Au­then­tic­a­tion: By ex­chan­ging the API key, it’s possible to check whether clients are actually au­thor­ised to access. It also checks whether the requested API is active.
• Au­thor­isa­tion: Once the project or service has been iden­ti­fied, the API server’s access rights determine the extent to which access is granted.

How can API keys be requested?

How you request or are assigned API keys depends on the API you want to connect to. Access rights vary based on the API operator. But usually the mapping of API keys follows this pattern:

• Go to the website of the provider whose API you want to access and log in to the developer page.
• Select API keys for existing projects or for creating new projects.
• Rename the API key for clarity.
• Once the API key has been created and assigned, you can insert it into the website or app for later access and data transfer. In future, the API server will recognise the calling ap­plic­a­tion via the API key.

The ad­vant­ages of API keys

The main benefit of API keys is the simple and fast au­then­tic­a­tion of access rights for users, services, or programs. Es­pe­cially when con­nect­ing different ap­plic­a­tions to exchange data or perform cross-program actions. Au­then­tic­a­tion keys are also helpful to pro­gram­mers creating an app who need access to a program via API. API servers can use the password-like keys to make sure no one gains unwanted access to the system.

API keys provide these enhanced au­then­tic­a­tion features:

• Re­gis­tra­tion of APIs, programs, services, or projects that want to access specific APIs
• Defined access rights of API servers and API operators to determine which APIs can authorise which kind of action and access
• Overview of past allowed or denied access
• Ad­di­tion­al security as one-time, unique, and secret keys
• Enabled blocking of uniden­ti­fi­able network traffic
• Control over the load by limiting the number of calls to an API
• Ad­di­tion­al filtering and assigning of certain access types or patterns to specific API keys

How important are API keys to security?

API keys alone are not a suf­fi­cient security measure, but provide an ad­di­tion­al level of access security. Since API keys are owned by clients like passwords, there’s also a risk of them being stolen by hackers. Like a stolen password, un­en­cryp­ted stolen API keys can quickly lead to un­au­thor­ised system access. Since API keys usually remain visible in server logs, they can give hackers access under the guise of sup­posedly le­git­im­ate access. Often, they’re involved in cy­ber­at­tacks like DDoS attacks, man-in-the-middle attacks or in­jec­tions.

What you should know about API keys and security:

• API keys don’t identify specific users, but only APIs or programs that request access.
• Unlike passwords, API keys are usually stored un­en­cryp­ted on the client side and remain visible in server logs.
• API keys, like unsafe passwords, can be stolen by hackers looking to gain access to an ap­plic­a­tion.

How can API keys be safely used?

Since programs use APIs to exchange sensitive data and grant access to internal ap­plic­a­tions, reliable API security is critical. Here’s how you strengthen APIs with ad­di­tion­al security measures:

• Restrict and protect access to client-side API keys.
• Use a separate API key for each project and ap­plic­a­tion.
• Delete API keys that you no longer need.
• Encrypt stored API keys as cre­den­tials-at-rest to prevent key theft.
• Don’t integrate API keys into code in a clearly readable way or store in the source structure
• Monitor the use of API keys, for example if several pro­gram­mers are using REST APIs via OpenAPI.

API keys and data pro­tec­tion

Another important aspect of API keys is privacy. This starts when you install a new app on your phone and it asks for ad­di­tion­al per­mis­sions. And you might not even be checking what per­mis­sions an app is re­quest­ing. If the service is ques­tion­able, you could un­in­ten­tion­ally be giving away access to all your Facebook data, photos, or phone storage. The result is a com­pre­hens­ive col­lec­tion of data or, in an emergency, even a system takeover. To prevent data misuse, make sure to only give trusted apps access via an API key.