Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

It is now common to use an API Key to identify an agent when dealing with an API. What are the merits of doing that over using a username specified by the developer? Is it simply that the API Key is harder to guess, or is there a deeper reason?

share|improve this question
1  
What API's where? API is a very broad term covering every imaginable programming interface. Passing a string user ID in every API call, instead of an abstract session ID of some kind, is dumb. –  Kaz Mar 20 '13 at 18:46
add comment

4 Answers

up vote 2 down vote accepted

I can think of a number of reasons you might use a key:

  • Prevent guessing, especially if the key doubles as part of the authentication. This is what Terry's answer is trying to tell you - why allow a malicious user to simply try multiple user names from a dictionary when you can make them search a large address space (it would need to be be pretty big, bigger than 128-bit at least). Combined with rate-limiting and IP blocking, you would filter out a large number of attacks.
  • Prevent the users' account being compromised if the user name is public. If my username is antony and my API key is antony, great, you're half way to breaking in. However, if my API key is something random, it becomes much harder (see point 1).
  • Allow multiple devices to access the system and by extension enable a kind of access-control for devices. If you have one memorable username as your API key, this becomes hard to revoke unless there is a corresponding API secret. If you're using API secrets, having per-device secrets achieves a similar thing.
  • Prevent a leaked key from identifying the user in any way. This is, of course, entirely useless if the content of the application or device identifies the user.

This list is probably not exhaustive.

share|improve this answer
add comment

As others have stated its to create unique ID for each user.

But for AWS specifically, the "request authentication, theAWSAccessKeyId element identifies the secret key that was used to compute the signature, and (indirectly) the developer making the request."

Ref: http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html#ConstructingTheAuthenticationHeader

share|improve this answer
add comment

In most systems I seen, API keys do not merely act as a means of identification. They usually double as a means of authentication.

The developer isn't going to be typing the API key for each and every request he makes. The key will probably be stored in the code or a configuration file somewhere. There is no point in allowing the developer to choose a memorable username and password combo over a random API key.

share|improve this answer
    
When the API Key is used for authentication, what is the purpose of the API Secret? Take for example, AWS S3. –  Sinan Taifour Mar 20 '13 at 12:17
    
@SinanTaifour to use a real world example, your bank account number is a API Key, the information does not need to be kept secret, in-fact it is written on every check you hand out, however you don't go posting your bank account number on every billboard you find. Your PIN to use to call in and do phone banking would be your API Secret, you never reveal that to anyone. –  Scott Chamberlain Mar 20 '13 at 22:14
    
@ScottChamberlain, I understand that, but I was going by Terry's logic. According to his logic, the API key is part of the authentication (that is, it needs to be kept secret). –  Sinan Taifour Mar 21 '13 at 13:31
add comment

The API key is simply to identify what service is making the request. I don't know that there is any particular reason for them to be the way they are other than because it is easier to just hand out random keys rather than usernames since it is all handled by computers and it avoids issues of people wanting the same username.

Perhaps there might also be cases where the username could be chosen to be deceptive. I'm not sure how effective this would be since it isn't something that the average user would see and I hope a more experienced user wouldn't fall for it, but if you could make your Facebook API username "FacebookAdmin" it wouldn't be particularly good.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.