I was playing about with youtube's API yesterday and did some research about its security. Now.. I have a website which I would like to apply Youtube API for it and I just wonder how NON-secure is to display project's API key? I would be using js for that and I mean there is no way I can hide it anyways as everyone who really is looking for it would be able to find via inspect element or just a source code..

Is it enought just to specify a domain name you are using this api key with so no one can use it?

If I am completely wrong please give some information regarding this question.

  • Do you need to expose your api key through client code? Sometimes you can send users' requests through your server, apply the api key and deliver them to YouTube. A kind of proxy put simply. That way the end user will never see the key – Alex Nov 27 '15 at 19:19
  • I need to retrieve json information and I can only do it via get function. For example gettinng some videos of a playlist https://www.googleapis.com/youtube/v3/playlistItems?part=snippet&maxResults=4&key={YOUR_API_KEY} therefore I will have to use my api key in javascript so everyone will see it – StuckBetweenTrees Nov 27 '15 at 19:39
  • Is it not enough just to supply domain name for an api? Like I can do for my youtube api -> Accept requests from these HTTP referrers (web sites) (Optional) – StuckBetweenTrees Nov 27 '15 at 19:41
  • Google has good support on their Groups site. They may be able to help you – Neil Smithline Nov 27 '15 at 20:23
  • 1
    One way of doing it is sending your users' requests to your server which rewrites the request with your api key and sends it to YouTube/Google. So that a user request a query which is sent to the server which is sent to google which is returned to the client. – Alex Nov 27 '15 at 20:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.