Is it possible to store a user's third-party private API key securely?

Question

Let's say there is a website called Service. Service has a read-only API. A user of Service has an API key that they can change at any time if they think their API key has been compromised. If I want to read info on a user from the API, I just give Service a url like service.com/api&request=info1,info2&key=aBc123 and I get JSON of whatever I requested.

I'm trying to create a graph of live event data of which a certain user has, and provide this info to other users. This requires the certain user's API key be stored for the duration of the event, since the API only gives me entries from so far back. I would ask for certain user's API key before the event, use it to access the API, and store the key until the event is over.

I also want to use each user's API key to verify that they have permissions to view the graph, as the API tells me if users are in the same group or not.

My graph app would be hosted on a simple shared website thing from something like Namecheap or Bluehost, so that certain user does not have to keep their computer online.

Is it possible to handle and store the API key in such a way that I cannot steal another user's API key? Or do users just have to trust that I won't peek? Do I need to worry about the security of the key while it is being transmitted, either from the user to me or from me to the service?

Answer 1

It is not certain that there is a 100% secure solution to any static-secret problem (that's what you're describing btw). Also, there is always a trust relationship between your users and your service. You certainly don't want to be storing your user's secrets -- use it and discard it immediately is a good model.

All risks must be properly assessed, according to impact, likelihood, etc. For example, I use the excellent service, OctoTree, with GitHub. I have given them an access key to my account. I trust them because I don't have any private repos (and therefore the impact of disclosure is low), and it doesn't profit them to misuse or disclose this information. For me the risk is low so I give access to OctoTree. Your users will have to make the same assessment with you.

Btw: having a private key in a URL, as suggested by your post, is totally insecure anyway, so you don't have to worry about security on your end.

If you must store someone's key, use Hashicorp Vault's kv store. If you can run it, then it's the most secure you're likely to get.