API keys and how to protect them
What API keys are and how to handle them safely as a consumer and as a provider: keeping keys out of code, git and front ends, environment variables and secret managers, restricting and rotating keys, what to do after a leak, and how to issue, hash and scope keys in your own API.
CodexBash, , 6 min read
An API key is a secret string that identifies and authorises a caller of an API: a payment gateway, a maps service, an AI model, an email provider, or your own backend. Whoever has the key can act as you, spend your money, read your data or send email in your name. Leaked keys are one of the most common causes of security incidents and surprise bills, and automated bots scan public code for them within minutes of a push. This article covers how to protect keys you use, what to do when one leaks, and how to design keys properly if you provide an API.
Sign in to read the rest
The whole 6 minute article is free with an account, along with every problem, lesson and tutorial. No card.