Contents
How is an API key like a password?
Since the API key provides direct access to data, it’s pretty much like a password that a user of a web or mobile app provides to gain access to the same data. Think about it.
Is it possible to protect the API key?
Trying to protect the key while it’s embedded in your software is ultimately a futile effort. No matter what you do, any attacker that has access to the binaries, source, and/or communications channel and is determined enough to get at they key will be able to do so.
How to hide API key in source code?
I’m have two keys to work with: a public key (as the name suggests, it doesn’t have to be treated with the same care as the private), and a private key, which needs to be kept secure from others. Any ideas on how I could do this would be greatly appreciated.
Where is the private key in object code?
A private key would be outside the object code and in another file. The hard part is providing this private key to the user. Once it is provided, you can use a signature of the private key, tacked onto the end of the file, and a public key within the application, to verify the integrity of the private key.
Why do we need to store an API key?
Since the API key provides direct access to data, it’s pretty much like a password that a user of a web or mobile app provides to gain access to the same data. Think about it. The reason we need to store API keys is to make sure that the API key in the request is valid and issued by us (just like a password).
Is it easy to type on a mobile phone?
Typing is easy when users do it on a desktop computer. But it’s harder to do on a mobile device because not all the keys are visible on the keyboard at once. A smaller screen can only display a limited set of keys. Most mobile operating systems have designed separate keyboards optimized for specific form field inputs.
What are some common mistakes that API key providers make?
One common mistake that API key providers make is providing one key to access everything, since it’s easy to manage. Don’t do that. Assume that a user just needs to read an email, and generates an API key. But that key now has full access to other services, including deleting records in the database.