An application programming interface (API) key is a unique code used by an application programming interface to identify the calling application or user. API keys are used to track and control who uses the API and how they use it, as well as to authenticate and authorize applications, functioning similarly to usernames and passwords. API keys can appear as a single key or a set of multiple keys. Users should follow best practices to improve overall security, prevent API key theft, and avoid the consequences of API key leaks.

What is an API Key?

API keys are used to control and track who uses the API and how they use it. The term "API key" can mean different things for different systems. Some systems have only a single code, while others have multiple codes for a single "API key."

Thus, an "API key" is a unique code or set of unique codes used by an API to authenticate and authorize the calling user or application. Some codes are used for authentication, while others are used to create cryptographic signatures to prove the legitimacy of a request.

Authentication codes are generally collectively referred to as "API keys," while codes used for cryptographic signatures have various names, such as "encryption keys," "public keys," or "private keys." Authentication involves identifying the entities involved and confirming whether their identity matches what they claim.

On the other hand, authorization specifies which API services are allowed to be accessed. API keys function similarly to usernames and passwords for accounts and can be linked to other security features to enhance overall security.

Each API key is typically generated by the API owner for a specific entity (details below). Every time an API endpoint is called, user authentication or authorization (or both) is required, and the relevant key is used.

Cryptographic Signatures

Some API keys use cryptographic signatures as an additional layer of authentication. When a user sends certain data to an API, they can add a digital signature generated by another key to the request. Using cryptography, the API owner can verify whether this digital signature matches the sent data.

Symmetric vs. Asymmetric Signatures

Data shared via APIs can be signed using cryptographic keys. The following are the categories of keys:

Symmetric Keys

This type of key involves using a single cryptographic key for both signing data and verifying the signature. In the symmetric key category, the API key and encryption key are usually generated by the API owner, and the API service must use the same encryption key to verify the signature. The main advantage of using a single key is that generating and verifying signatures is faster and requires less computational power. Hash-based Message Authentication Code (HMAC) is a typical example of a symmetric key.

Asymmetric Keys

This type of key involves the use of two keys: a private key and a public key. They are distinct but cryptographically related. The private key is used to generate signatures, while the public key is used to verify signatures. The API key is generated by the API owner, while the private and public key pair is generated by the user. The API owner only needs to use the public key for signature verification, and the private key can remain locally encrypted.

The main advantage of asymmetric keys is that the signature generation and verification keys are separated, providing higher security. This allows external systems to verify signatures without being able to generate them. Another advantage is that some asymmetric encryption systems support adding passwords to private keys. RSA key pairs are a typical example.

Are API Keys Secure?

The security of API keys depends on the user. API keys are similar to passwords and must be treated with caution. Sharing an API key is almost like sharing a password. Doing so puts the user's account at risk, so it should not be done.

API keys can perform powerful operations in a system and are often targeted by cyberattacks. These operations include requesting personal information or executing financial transactions. In fact, there have been cases where web crawlers attacked online code databases and successfully stole API keys.

The consequences of API key theft can be severe, potentially leading to significant financial losses. Additionally, some API keys do not expire. Once stolen, attackers can use them indefinitely as long as the key itself is not revoked.

Best Practices for Using API Keys

Since API keys can access sensitive data and are often vulnerable, secure usage is crucial. To improve overall security when using API keys, please follow these best practices:

1. Change API keys as frequently as possible. This means deleting the current API key and creating a new one. For multiple systems, generating and deleting API keys is easy. Some systems require users to change passwords every 30 to 90 days. Similarly, try to rotate API keys at this frequency.

2. Use IP whitelisting: When creating an API key, compile a list of IP addresses authorized to use the key (i.e., an IP whitelist) or a detailed list of blocked IPs (i.e., an IP blacklist). This way, even if the API key is stolen, unrecognized IPs will not be able to access it.

3. Use multiple API keys: Having multiple keys and assigning specific roles to each can reduce security risks, as security is not dependent on a single key with broad permissions. You can set different IP whitelists for each key to further mitigate risks.

4. Store API keys securely: Do not store keys in public places or on public computers; do not store them in plain text. Instead, for enhanced security, encrypt them or use an encryption manager to store each key separately to avoid accidental exposure.

5. Do not share your API keys. Sharing an API key is almost like sharing a password. Sharing means granting another party your authentication and authorization privileges. If an API key is leaked, it can be stolen and used to infiltrate your account. API keys should only be used by you and the system that generated them.

If an API key is leaked, disable it immediately to prevent further damage. If financial losses occur, take screenshots of key information related to the incident, contact the relevant authorities, and file a police report. This is the best practice to increase the chances of recovering lost funds.

Conclusion

API keys provide core authentication and authorization functions, and users must carefully manage and protect their keys. Ensuring the secure use of API keys should consider multiple layers and factors. In summary, API keys should be treated like personal account passwords.