Application programming interface key

This article needs additional citations for verification. Please help by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources:  –  ·  ·  · scholar · JSTOR (October 2018) (Learn how and when to remove this template message)

An application programming interface key (API key) is a unique identifier used to authenticate a user, developer, or calling program to an API.^[1] However, they are typically used to authenticate a project with the API rather than a human user.^[1][2] Different platforms may implement and use API keys in different ways.

Usage[]

The API key often acts as both a unique identifier and a secret token for authentication, and will generally have a set of access rights on the API associated with it.^[3]

HTTP APIs[]

API keys for HTTP-based APIs can be sent in multiple ways:^[4]

In the query string:

POST /something?api_key=abcdef12345 HTTP/1.1

As a request header:

GET /something HTTP/1.1
X-API-Key: abcdef12345

As a cookie:

GET /something HTTP/1.1
Cookie: X-API-KEY=abcdef12345

Security[]

API keys are generally not considered secure; they are typically accessible to clients, making it easy for someone to steal an API key. Once the key is stolen, it has no expiration, so it may be used indefinitely, unless the project owner revokes or regenerates the key.^[2] If an API key is meant to be accessible to the client, it is only considered secure if used together with other security mechanisms such as HTTPS/SSL.^[4]

References[]

External links[]

• Why and When to Use API Keys

This computer-programming-related article is a stub. You can help Wikipedia by .

• v
• t