API Keys Explained: Scope, Restrictions and Safer Website Integration

The six points in the video

This is a silent video. The headings, explanations and labels below reproduce the information on screen.

1. 1

   Step 1: Know which service issued it

   0:18

   A key is used with the API or service that recognises it.

   On-screen labels: Issuing provider; Intended API; Correct project.

2. 2

   Step 2: Understand its actual powers

   0:30

   Keys differ; check the permissions and billing implications.

   On-screen labels: Allowed operations; Account scope; Usage implications.

3. 3

   Step 3: Apply supported restrictions

   0:42

   Limit the key to suitable APIs and allowed callers where supported.

   On-screen labels: API restrictions; Caller restrictions; Minimum access.

4. 4

   Step 4: Keep private keys off the page

   0:54

   A credential embedded in browser code can be inspected by visitors.

   On-screen labels: Public browser code; Private server credential; Provider-approved setup.

5. 5

   Step 5: Monitor relevant usage

   1:06

   Review activity and investigate unexpected patterns.

   On-screen labels: Usage reports; Unexpected requests; Responsible owner.

6. 6

   Step 6: Plan a controlled replacement

   1:18

   If a key is exposed, follow provider guidance to replace and revoke it.

   On-screen labels: Replacement key; Updated integration; Old key revoked.

Common questions

Go further