I'm learning the way to use API right now. Since I want to publish the code on GitHub, I have some question about it.

1. I will use public API, however, there are APIs with authorization and those don't (as listed here). I learned that publish an API call with API key will be a bad idea, however, for the APIs without key, it won't matter, right?

2. Let say if I make a call to Lorem Picsum (a free image API without API key) in my code, is it legal to push the codebase to GitHub public repository (without executable file)? Is it legal to make an executable file and put to release section? I cannot find any clear information about this, since they don't have Q&A section. However, as the Lorem Picsum project is under MIT license, and after reading this blog post by one of the author, I think it is legal to do so.

When I look at other APIs like Placeholder or Pexels, it seems like there is a restriction when putting the application to production server, or the application has a high amount of request to the API server, which make senses. The thing is, an application, or code snippet, I want to make are simply out-of-class/personal project that I make during spare times (I'm still a student). Certainly, it isn't the same as what commercial apps do; well, unless my repository somehow becomes popular and my application is downloaded 1 million times, then it will be a different story.

3. For the matter that I asked in question 2, can it be applied to all public API, or will it vary from one to another?

Thanks for the answers


  • The question is more about conventional practice, so I don't include the detail about code or environment. It should be applied to all type of API call.
  • Link to GitHub project (as suggested): https://github.com/hunghvu/dynamic-wallpaper
  • BTW you don't define what exactly do you call an API and you don't tell what operating system and compiler are you coding it on (C++ is not the same as JavaScript, and Windows is different of Linux). I also suggest to give the URL of your github project. Feel free to send me an email to basile@starynkevitch.net mentioning the URL of your question – Basile Starynkevitch Sep 1 at 15:46
  • Because this question is more about conventional practice, not really a coding question so I don't include information as you suggested, is it a right way to think? However, I'm going to add an URL to my GitHub project and flag my question to move to opensource as requested. – Hung Vu Sep 1 at 16:06

No, there's no issue at all. Publishing a code or library that accesses an API is almost never an issue, even for private APIs. If an API provider don't want you to publish any details about their API, they'll require you to sign a non-disclosure agreement before you can even see the documentation for the API, and this is very, very rare.

API key is usually used by API providers for two purposes:

  • access control
  • rate limiting

Access control is decided together between you and the API provider. Someone with your API key can impersonate you when accessing the API provider, which can grant them access to privileges that they shouldn't. For example, an API key to a social network site might allow anyone to post as you and edit any contents you posted.

A second aspect of access control is that some commercial/paid API provider will require that you don't publish your API key because they lose revenue when other people can access their service without paying. These services may terminate your API key if you publish them publicly, as you'll be violating their terms of service.

For API providers that provides free, open service, then generally the API provider won't care if you publish your key as anyone can get one for free anyway, but services provided for free very often will enforce fair use and rate limiting. If someone steals your API key, they can use up your rate limit credits, and if the API provider blocks your key for excessive usage, that means they can cause a denial of service to your application. So while the API provider might not have a stake in requiring that you restrict your API key, you may not want to do so for your own interest.

Lorem Picsum project is under MIT license

The license of the project is irrelevant if you're simply using the service. You'd want to look for the license for the content, not the Lorem Picsum code. Lorem Picsum sources their images from Unsplash so their license is what's relevant to the usage of the images. Lorem Picsum's MIT license would only be relevant if you're trying to make an image placeholder service similar to Lorem Picsum, the MIT license grants you the ability to use Lorem Picsum's code to build your own image placeholder service.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.