CODEWITHSUNDEEP
youtubegoogle-apiyoutube-apiyoutube-javascript-api
Sean Anderson
Sean Anderson

Reputation: 29331

Protecting YouTube v3 API key in a client-side application

I'm looking at the following guide: https://developers.google.com/youtube/v3/getting-started

The first step of interacting with YouTube's API is:

You need a Google Account to access the Google Developers Console, request an API key, and register your application.

And they continue on to show an example where they use the key:

URL: https://www.googleapis.com/youtube/v3/videos?id=7lCDEYXw3mM&key=YOUR_API_KEY &part=snippet,contentDetails,statistics,status

I have a client-side application which is used by many people. The application issues search requests to YouTube's API. YouTube's API has a request limit of 50 million requests per day.

Since it's a client-side application, my API key is embedded into the code.

Today, a malicious user scripted something to max out the requests: enter image description here

I'm wondering what recourse I have to be able to defend against this sort of activity. Is my only option to host a server, route all needs for YouTube's API through my server, and deny requests when they come too frequently?

I have real concerns about implementing something like that. It would effectively double the wait time for every API request and also tax the server a seemingly unnecessary amount, but perhaps it is needed.

Do I have any other options available to me?

Thanks

Upvotes: 7

Views: 6591

Answers (7)

John
John

Reputation: 195

That is correct. When you make your key make sure you use the REFERERS so that even if they do get your key it will not work for them!

Upvotes: 0

Ibrahim Ulukaya
Ibrahim Ulukaya

Reputation: 12877

This was due to a quota cost increase, it's temporarily reverted. We'll announce cost changes in http://apiblog.youtube.com/ and https://developers.google.com/youtube/v3/revision_history going forward.

Upvotes: 2

dolla Thanhcv
dolla Thanhcv

Reputation: 1

We also see this error, it seems to be too large deviations. results Overview is 813.844, but the APIs are Used 49,379,348 of 50,000,000 requests today

Upvotes: -1

brett rogers
brett rogers

Reputation: 6581

It appears to be a major bug. Same problem here - quota usage spiked like crazy starting on Sept. 3 and requests now cost WAY more than the documentation states.

Someone reported it as a defect in their bug tracking system. I suggest everyone affected go there and star the defect to help call attention to it:

Upvotes: 1

cujo30227
cujo30227

Reputation: 770

Don't think it is a malicious user. I think something's wrong on YouTube's side, since I'm seeing exactly the same issue with API requests made from my app enter image description here

Upvotes: 4

mpgn
mpgn

Reputation: 7251

You can use restriction to secure your API Key.

Use the REFERERS attribute of the public API key. Go to your project in console developers -> API&Auth -> Credentials

  • If you use Key for browser applications, REFERERS is a reference to a domain.
  • If you use Server key, REFERERS is a reference to a IP. (ip of your server for example)

For example, if you use github.io to make live demo of an application, REFERERS will point on http://user.github.io/*

You can read more register your application

  • Use a server key if your application runs on a server. Do not use this key outside of your server code. For example, do not embed it in a web page. To prevent quota theft, restrict your key so that requests are only allowed from your servers' source IP addresses.

  • Use a browser key if your application runs on a client, such as a web browser. To prevent your key from being used on unauthorized sites, only allow referrals from domains you administer.

A screen to help you :
enter image description here

Upvotes: 3

Zz'Rot
Zz'Rot

Reputation: 914

I propose the following ideas:

  • You can make sure the user accessing your page is a human (with Captcha, etc.)
  • Hide your API call behind an AJAX call that is triggered by your front-end (like GET /callgoogleapi);
  • The handler of AJAX call can set a frequency threshold, i.e. 2 requests per second. If too fast, the API call is not made, and AJAX replies a message like "User operation too fast".

Upvotes: 0

Related Questions