Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Scenario:
Considering this "tight budget" scenario, would it be better to enter the API key every login and store it in a session variable instead of storing it hard-coded (e.g., inside config.php)? Or what are better ways to store 3rd party API keys inside your software?
No, storing it in a session variable isn't going to protect you against your hosting provider stealing it.
The session variable will either be a cookie sent back and forth with every request or a server-side session. Either way the server has access to the key and anyone who controls the server does as well.
So it doesn't add security, sounds like a major inconvenience and could expose you to other threats (like leaking the cookie to a third party).
As a general rule of thumb, API keys should be accessible to whoever's gonna use them. If the server is the one using the key, the client has no business with it.
You could store it encrypted on the server and decrypt it with your login information upon login. It's still security theater, but at least it doesn't inconvenience you (the user) beyond the initial setup.
$_SESSION.