A password for software, and it is just as often carelessly stored.
An API key is a unique string of characters that identifies a system to another service. Whoever has the key can trade on your behalf: and also charge your account for paid services. Treat it like a password.
IN COMMON LANGUAGE
Where keys leak
The most common cause is a key in code that ends up in a public repository. There are programs that continuously scan for this.
The second is a key in the code of the website itself, visible to every visitor. Everyone can read everything that reaches the browser.
WHY IT MATTERS
How to do it right
Store keys in environment variables outside your code files, and put those files on your version control exclusion list.
Give each link its own key with only the permissions it needs, so you can revoke one without breaking the rest.
- Never in code — and never in version control.
- Never in the browser — everything there is readable.
- Own key per link — so you can move in in a targeted manner.
- Minimum rights — only what the link needs.
- Replace immediately if leaking — withdraw and reissue.
FREQUENTLY ASKED QUESTIONS
More about an API key
What if a key leaks?
Withdraw it immediately and issue a new one. Then check the service's usage log for unexpected activity: with paid services, a leaked key can quickly cost money.
Why is the AI key in my name?
Because you are the owner of the account and the consumption. You can withdraw it at any time and see exactly what is being used, without having to depend on us.
How do you store keys?
Outside the code files, outside version control and with only the rights that the link needs. That's standard practice and it's forgotten more often than you might think.
CONTINUE READING
Of course, continue reading about this subject.
Links safe set up?
We set up links with separate keys and minimal rights.