2

I am accessing a third-party API. It requires a key, which is the same key for all of my users. Currently, my application includes that key in the client-side code, and calls the third party API directly. So any user can decompile my code, and get the key tied to my application. (Bad, right?)

I am guessing that I need to have a server between the client and third-party. And the client makes a request to the server, which has the key. The server then makes the request to the third party, and returns the results to the client. Is this the right approach?

If this is the correct approach, would I build the server and run it on AWS? Or do third-party tools for this use already exist? (I saw AWS Gateway, but that appeared to be about building APIs, not accessing them.) How should I have a user access the third party, without giving them the secret key which is shared among all users?

Improve this question
1
  • Ask the API vendor.
    – user253751
    Nov 10, 2022 at 7:21

2 Answers 2

Reset to default
4

Popular services like Google use API key(s). This key should be protected as this is what is used to track your usage against the service. Many services are volume based and will charge appropriately based on usage.

Typically, these services are accessed via a server side component.

Client -> Your Service (API Key) -> Calls External Service

Then the client knows nothing about the key.

Improve this answer
2
  • 1
    This only helps if your service whitelists IPs. If your service runs on a blacklist model, you would have to find all rogue traffic and blacklist the IP, and it would only work until the next rogue comes along.
    – NH.
    Jul 11, 2017 at 17:30
  • 1
    @NH.: The question was how to safeguard the key, not how to validate and/or rate limit all incoming traffic to your service.
    – Flater
    Nov 11, 2022 at 5:10
2

Well, yes. If you don't want your users to be able to use the 3rd-party API on their own terms, then you have to proxy the access to that API and introduce a different kind of authentication between your users and the proxy.

It's always a good idea to reflect whether that is actually what you need to do, though. Why do you care whether your users use that API from within or without your app? Have you signed an agreement that you'll only let your registered users have that key? (Then this may be necessary to demonstrate good-faith efforts for compliance.) Are you concerned that users might overuse the API? That can be a valid reason, but of course then you have to add rate-limiting to your proxy rather than simply passing all authenticated requests on.

Improve this answer
1
  • I am concerned that someone could steal my key and use it to request APIs of their own. I am only allowed limited requests. Unlikely, but trying to cover all my bases.
    – Evorlor
    Jul 11, 2017 at 14:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.