API keys are useful for identifying applications, integrations, and machine clients—but they are usually bearer credentials: anyone who obtains a valid key can use its authority.
Generate Strong, Unpredictable Keys
Use cryptographically secure randomness and enough entropy that keys cannot be guessed. Give each credential a stable internal ID so it can be revoked without searching by secret value.
A common pattern is:
public key ID + secret random value
Do Not Store Raw Keys When You Can Avoid It
For API keys that only need equality verification, store a cryptographic hash of the secret and show the full key only once at creation.
For credentials that must later be recovered, use a proper secret-management/encryption design instead of plaintext database storage.
Keep Keys Out of URLs and Source Code
Send API keys in an appropriate request header, not query strings. URLs frequently appear in logs, browser history, proxies, and analytics systems.
Never commit production keys to Git or bake them into frontend/mobile code when secrecy is required. Anything shipped to an untrusted client should be assumed extractable.
Scope Every Key
Where possible, restrict a key by:
- allowed APIs/actions
- tenant/project
- environment
- IP/network or application identity where useful
- rate/concurrency limits
- expiration
One leaked read-only staging key should not provide production administrator access.
Rotate Without Downtime
Support overlapping credentials during rotation:
Rotate immediately after suspected exposure and remove unused keys to reduce attack surface.
Rate-Limit and Monitor Per Key
Track request volume, failure rate, IP/location anomalies where appropriate, and unusual resource consumption. Apply limits per key/tenant so one compromised integration cannot consume unlimited capacity.
API Keys Are Not User Authorization
An API key may identify an application or subscription, but OWASP explicitly warns against relying on keys alone to protect sensitive, critical, or high-value resources.
If the operation depends on a human user's identity and permissions, use a proper user authentication/authorization flow as well.
Final Takeaway
Treat every API key like a revocable scoped secret: generate it securely, store it safely, never leak it through URLs/source, restrict its authority, monitor its usage, and build rotation into the product before a compromise happens.
References
Discussion (0)