An application programming interface (API) key is a unique identifier used to authenticate and authorize a user, developer, or calling program to an API.[1] However, they are typically used to authenticate and authorize a project with the API rather than a human user.[1][2]
The API key often acts as both a unique identifier and a secret token for authentication and authorization, and will generally have a set of access rights on the API associated with it.[3]
API keys for HTTP-based APIs can be sent in multiple ways:[4]
In the query string:
POST /something?api_key=abcdef12345 HTTP/1.1
As a request header:
GET /something HTTP/1.1
X-API-Key: abcdef12345
As a cookie:
GET /something HTTP/1.1
Cookie: X-API-KEY=abcdef12345
API keys are generally not considered secure; they are typically accessible to clients, making it easy for someone to steal an API key. Once the key is stolen, it has no expiration, so it may be used indefinitely, unless the project owner revokes or regenerates the key.[2] Since API keys must only be accessible to the client and server, authentication using API keys is only considered secure when used in conjunction with other security mechanisms such as HTTPS.[4]
In 2017, Fallible, a Delaware-based security firm examined 16,000 android apps and identified over 300 which contained hard-coded API keys for services like Dropbox, Twitter, and Slack.[5]