Let's say there is a website called Service. Service has a read-only API. A user of Service has an API key that they can change at any time if they think their API key has been compromised. If I want to read info on a user from the API, I just give Service a url like service.com/api&request=info1,info2&key=aBc123 and I get JSON of whatever I requested.
I'm trying to create a graph of live event data of which a certain user has, and provide this info to other users. This requires the certain user's API key be stored for the duration of the event, since the API only gives me entries from so far back. I would ask for certain user's API key before the event, use it to access the API, and store the key until the event is over.
I also want to use each user's API key to verify that they have permissions to view the graph, as the API tells me if users are in the same group or not.
My graph app would be hosted on a simple shared website thing from something like Namecheap or Bluehost, so that certain user does not have to keep their computer online.
Is it possible to handle and store the API key in such a way that I cannot steal another user's API key? Or do users just have to trust that I won't peek? Do I need to worry about the security of the key while it is being transmitted, either from the user to me or from me to the service?