WEBVTT

00:00:00.000 --> 00:00:06.000
What should you check before putting an API key into a website?

00:00:06.000 --> 00:00:13.000
Understand what it identifies, what it permits and where it may be exposed.

00:00:13.000 --> 00:00:18.000
Treat the key according to its permissions.
6 API-key checks.

00:00:18.000 --> 00:00:30.000
Know which service issued it
A key is used with the API or service that recognises it.
Issuing provider · Intended API · Correct project

00:00:30.000 --> 00:00:42.000
Understand its actual powers
Keys differ; check the permissions and billing implications.
Allowed operations · Account scope · Usage implications

00:00:42.000 --> 00:00:54.000
Apply supported restrictions
Limit the key to suitable APIs and allowed callers where supported.
API restrictions · Caller restrictions · Minimum access

00:00:54.000 --> 00:01:06.000
Keep private keys off the page
A credential embedded in browser code can be inspected by visitors.
Public browser code · Private server credential · Provider-approved setup

00:01:06.000 --> 00:01:18.000
Monitor relevant usage
Review activity and investigate unexpected patterns.
Usage reports · Unexpected requests · Responsible owner

00:01:18.000 --> 00:01:30.000
Plan a controlled replacement
If a key is exposed, follow provider guidance to replace and revoke it.
Replacement key · Updated integration · Old key revoked

00:01:30.000 --> 00:01:39.000
Your checklist
Know which service issued it · Understand its actual powers · Apply supported restrictions · Keep private keys off the page · Monitor relevant usage · Plan a controlled replacement

00:01:39.000 --> 00:01:47.000
Use the provider rules for the key and the environment.
jerseyweb.je