An application programming interface (API) key is a unique code used by an API to identify a requesting application, application, or user. API keys are used to track and control who is using an API and how they use it. They also serve to authenticate and authorize applications — similar to how systems work with usernames and passwords. An API key can be a single key or a set of multiple keys. Users should follow best practices to improve overall security against API key theft and avoid consequences related to their API keys being compromised.
API vs. Chave API
To understand what an API key is, you must first understand what an API is. An application programming interface or API is a software intermediary that allows two or more applications to share information. For example, the CoinMarketCap API allows other applications to obtain and use cryptocurrency data such as price, volume, and market capitalization.
An API key can take many different forms — it can be a single key or a set of multiple keys. Different systems use these keys to authenticate and authorize an application, similar to mechanisms that use a username and password. An API key is used by an API client to authenticate an application making the request, i.e. calling the API.
For example, if Binance Academy wants to use CoinMarketCap's API, an API key will be generated by CoinMarketCap and used to authenticate the identity of Binance Academy (the API client), which is requesting access to the API. When Binance Academy accesses the CoinMarketCap API, this API key must be sent to CoinMarketCap along with the request.
This API key is for use by Binance Academy only and must not be shared or sent to any third party. Sharing this API key would allow a third party access to CoinMarketCap posing as Binance Academy. In other words, any actions by the third party would be treated as if they were from Binance Academy.
The API key can also be used by the CoinMarketCap API to confirm that the application is authorized to access the requested resource. Additionally, API owners use API keys to monitor API activity and information such as request type, traffic, and volume.
What is an API key?
The API key is used to control and track who is using a particular API and how it is being used. The term “API key” can mean different things for different systems. Some systems have a single code, others may have multiple codes for a single “API key”.
Therefore, an “API key” is a unique code or set of unique codes used by an API to authenticate and authorize the requesting user or application. Some codes are used for authentication, others are used to create cryptographic signatures and prove the legitimacy of a request.
These authentication codes are commonly referred to collectively as an “API key,” while the codes used for cryptographic signatures have various names, such as “secret key,” “public key,” or “private key.” The authentication process aims to identify the entities involved and confirm that they are who they say they are.
Authorization, on the other hand, specifies which API services are allowed to be accessed. The function of an API key is similar to that of a username and password; You can also connect it to other security features to improve overall security.
Typically, each API key is generated for a specific entity by the API owner (more details below) and each time a request is made to an API endpoint — which requires user authentication or authorization, or both — the corresponding key is used.
Cryptographic signatures
Some API keys use digital (cryptographic) signatures as an additional layer of verification. When a user wants to send specific data to an API, a digital signature generated by another key can be added to the request. Using encryption, the API owner can verify that this digital signature matches the data sent.
Symmetric and asymmetric signatures
Data shared through an API can be signed by cryptographic keys, which fall into the following categories:
Symmetrical keys
These involve using a secret key to perform data signing and verifying a signature. With symmetric keys, the API key and secret key are typically generated by the API owner and the same secret key must be used by the API service for signature verification. The main advantages of using a unique key are the speed of the process and the need for less computational power to generate and verify the signature. A good example of a symmetric key is HMAC.
Asymmetric keys
These involve the use of two keys: a private key and a public key, which are different but cryptographically linked. The private key is used to generate the signature and the public key is used to verify the signature. The API key is generated by the API owner, but the private key and public key are generated by the user. For signature verification, the API owner needs to use only the public key. Therefore, the private key can remain local and secret.
The main advantage of using asymmetric keys is the greater security offered by separating signature generation and verification keys. This allows external systems to verify signatures even without having the ability to generate them. Another advantage is that some asymmetric encryption systems support adding a password to the private keys. A good example is an RSA key pair.
Are API keys secure?
The responsibility for an API key lies with the user. API keys are similar to passwords and need to be treated with the same care. Sharing an API key is like sharing a password, meaning it is not recommended as it would put the user's account at risk.
API keys are often targeted in cyberattacks because they can be used to perform powerful operations on systems, such as requesting personal information or executing financial transactions. In fact, there have been cases of hackers managing to attack online code databases to steal API keys.
The consequences of API key theft can be drastic and lead to significant financial losses. Additionally, as some API keys have no expiration date, they can be used indefinitely by attackers once stolen, until the respective keys are revoked.
Best practices when using API keys
Due to access to sensitive data and the general vulnerability of API keys, secure use of these keys is of paramount importance. When using API keys, you can follow these best practices and improve your security:
If possible, change your API keys frequently. To do this, you must delete your current API key and create a new one. You can easily generate and delete API keys across multiple systems. Just as some systems require you to change your password every 30 to 90 days, you should change your API keys with a similar frequency.
Use an IP whitelist: When creating an API key, define a list of IPs authorized to use the key (whitelist for IP addresses). You can also define a list of blocked IPs (blacklist for IP addresses). This way, even if your API key is stolen, it cannot be accessed by an unrecognized IP.
Use multiple API keys: having multiple keys and dividing responsibilities between them reduces risks, as your security will not depend on a single key with many permissions. You can also define, for each key, different whitelists for IP addresses, further reducing risks.
Store API keys securely: Don't store your keys in public places, on public computers, or in their original plain text format. Instead, for greater security, store each one using encryption or a manager and be careful not to accidentally expose them.
Don't share your API keys. Sharing your API key is like sharing your password. By doing so, you grant the other person the same authentication and authorization privileges that you have. Your API key can be stolen and used to hack your account. An API key should only be used between you and the system that generates it.
If your API key is compromised, you first need to deactivate it to prevent further damage. If there is any financial loss, take screenshots of key information related to the incident, contact the related entities and file a police report. This is the best way to increase your chances of recovering lost funds.
Final considerations
API keys provide basic authentication and authorization functions, and users must manage and protect their keys carefully. There are many layers and different aspects to ensure the secure use of API keys. In general, an API key should be treated like a password.
Further reading
General Security Principles
5 Common Cryptocurrency Scams and How to Avoid Them