CODEWITHSUNDEEP
javascriptapiweb-applications
screenglow
screenglow

Reputation: 1886

What to do with unique API keys in JavaScript?

I am new to web javascript development and playing around with apps and scripts for some of the public API's around the web. When a site issues you a unique key to identify your application you code that into your script so you can access the sites API but then anyone who can visit your site can also inspect the source of your JavaScipt so they could see/take/use your API key.

While there's no direct security issue for your own site here, doesn't it mean that anyone else could take my API key and use it for their own app which is completely different? How does one go about making this secure or storing it in a secure way?

What is the best practice in this regard?

Upvotes: 2

Views: 479

Answers (3)

Emmett
Emmett

Reputation: 14327

APIs typically offer domain authentication as an alternative to an API secret, for when the API needs to be called from client-side code.

Upvotes: 3

capdragon
capdragon

Reputation: 14899

Usually these KEYS are mapped to a domain. So another person's domain will not be able to use your key.

Upvotes: 2

speshak
speshak

Reputation: 2477

Generally API keys are tied to a domain. So even if someone tries to use your key it won't work on any domain but the one for the site it was issued for.

Upvotes: 3

Related Questions