0

When dealing with an API key (in this case a JSON file used to connect to the Google Analytics API), what is the appropriate way to securely store the keyfile?

"Your new public/private key pair is generated and downloaded to your machine; it serves as the only copy of this key. You are responsible for storing it securely."

Is the idea here that only specific user groups should have access to the API key? Say an administrator? Or if I have this on my server is that acceptable?

Improve this question
4
  • Tell me: What does the API key do?
    – user253751
    Oct 14, 2020 at 15:47
  • The API key is used to identify that I am an authorized user when connecting to Google Analytics.
    – Sean Payne
    Oct 15, 2020 at 13:44
  • What would happen if someone else got the API key? And do you need the API key to do things that the server needs to do?
    – user253751
    Oct 15, 2020 at 14:46
  • If someone also had the view ID, which is the unique identifier for the client, then they could pull analytics from the client's data. However, I have an easier time of keeping the view id less (easily) accessible since it will be stored in a database. To elaborate on the use case, this is for a dashboard which many clients will access and check their analytics. As far as what the server needs to do, it needs to pull these analytics on a monthly basis and store them in a database. I would imagine that this is more secure on the server side, rather than the client side.
    – Sean Payne
    Oct 17, 2020 at 2:39

1 Answer 1

Reset to default
-1

You would typically treat API keys as a secret and store them appropriately. Generally this means using some sort of encrypted store (think of a password manager for applications) that integrates with your application deployment process or runtime. Some examples would be HashiCorp Vault, Azure Key Vault or the Kubernetes Secrets (https://kubernetes.io/docs/concepts/configuration/secret/) integration.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.