Contents
How do I keep my API keys private?
To help keep your API keys secure, follow these best practices:
- Do not embed API keys directly in code.
- Do not store API keys in files inside your application’s source tree.
- Set up application and API key restrictions.
- Delete unneeded API keys to minimize exposure to attacks.
- Regenerate your API keys periodically.
Why can sharing an API key be problematic?
Sharing of API keys becomes more of a concern if the API key authenticates someone for access to a subset of data. The methods of protecting API keys depends on the technology that you are using.
What is the purpose of API keys?
An application programming interface key (API key) is a unique identifier used to authenticate a user, developer, or calling program to an API. However, they are typically used to authenticate a project with the API rather than a human user. Different platforms may implement and use API keys in different ways.
How to store and protect private API keys?
Keep your secrets on some server on internet, and when needed just grab them and use. If user is about to use dropbox then nothing stops you from making request to your site and get your secret key. Put your secrets in jni code, add some variable code to make your libraries bigger and more difficult to decompile.
Using the time honored tradition of indirection, share the secret between your API endpoint and an app authentication service. When your client wants to make an API call, it asks the app auth service to authenticate it (using strong remote attestation techniques), and it receives a time limited (usually JWT) token signed by the secret.
Is it difficult to detect secrets like API keys?
As they introduce a single point of failure, they must be hosted on a highly-available and secure infrastructure It can be difficult to detect when an attacker is using secrets like API keys maliciously, because often, they are using them within their scope.
Why is it important to restrict access to an API key?
By restricting access and permissions of the API key you not only limit damage and restrict lateral movement, you also provide greater visibility over when a API key is being used outside of its scope. When using external services, make sure the permissions of that API matches the task it is fulfilling.