• App is hosted on a shared server (hosting provider can see config files if they want to).
  • App must use an API key of a 3rd party service.

Considering this "tight budget" scenario, would it be better to enter the API key every login and store it in a session variable instead of storing it hard-coded (e.g., inside config.php)? Or what are better ways to store 3rd party API keys inside your software?

  • I assume that by "session variable" you mean an environment variable in the shell, yes?
    – grochmal
    Commented Sep 5, 2016 at 22:42
  • @grochmal not really, sessions like PHP $_SESSION.
    – IMB
    Commented Sep 5, 2016 at 23:02
  • Wait, if you need the API in $_SESSION the enduser must know the API key, if you store it in a config file it is the operator who knows the key. I'm confused on how many API keys are out there: one per user? one per server?
    – grochmal
    Commented Sep 5, 2016 at 23:20
  • 1
    What's your threat model? ;-)
    – GnP
    Commented Sep 5, 2016 at 23:44
  • @grochmal only 1 user, only 1 API Key
    – IMB
    Commented Sep 6, 2016 at 12:30

1 Answer 1


No, storing it in a session variable isn't going to protect you against your hosting provider stealing it.

The session variable will either be a cookie sent back and forth with every request or a server-side session. Either way the server has access to the key and anyone who controls the server does as well.

So it doesn't add security, sounds like a major inconvenience and could expose you to other threats (like leaking the cookie to a third party).

As a general rule of thumb, API keys should be accessible to whoever's gonna use them. If the server is the one using the key, the client has no business with it.

You could store it encrypted on the server and decrypt it with your login information upon login. It's still security theater, but at least it doesn't inconvenience you (the user) beyond the initial setup.

  • I agree, there is no good way to protect the API from the hosting provider. The provider can login as root (or change /etc/passwd and then login as root) and even get an encryption key from memory with a debugger or read environment variables from /proc.
    – grochmal
    Commented Sep 6, 2016 at 15:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .