2

I'm trying to consume a payment processor API (not developed by my), but (being honest) I don't know anything about security, I don't understand API keys and authentication, I have multiple questions about API's that I couldn't resolve no matter how much research I did, the questions are:

  1. What could happen if someone steal the payment processor API keys? I mean, I know for example that if someone steals your Google API keys he can use Google API charging it to my credit card (there are multiple cases all around the world), but in this case the API keys are used to process the payment, I don't understand what they can do with my API keys

  2. Where should I store my keys, I'm using React.js CRA as Front-end and PHP as backend, I was making some research and this is what I found:https://medium.com/better-programming/how-to-hide-your-api-keys-c2b952bc07e6

    the post says: "if you wish to totally mask your key, you should make a backend that proxies your requests, and store the API key there", so at this point my question is should I send the request to my backend then my backend sends a request to payment processor API?.

  3. When developing my own API should I use authentication no matter what I am going to do?, I mean, I know that authentication is for user login functionalities, but, should I use Auth to bring products from a database?

  4. When generating API keys for others to use my service, is it safe to store them in a database?

Please try to be gentle I don't understand security, I'm trying to do my best

6
  • Does the payment processor provide you with any guidelines? Or does it require you to be compliant with any of the standards? – Limit Feb 18 at 0:31
  • No, they don't provide guidelines, you can read the docs here: docs.epayco.co/payments/token#scroll-api – Ger Feb 18 at 2:43
  • Thats not good. If you are working with credit cards and cards in general, you should look at PCI standards to make sure you are a reliable merchant – Limit Feb 18 at 17:10
  • I don't store payment information, so Should I care about PCI if the payment processor already does?, if so Can you explain me how it works @Limit, I'm new to security, thanks – Ger Feb 18 at 17:20
  • 1
    I mean generating API keys for others to use my service – Ger Feb 18 at 18:12
2

An API Key is a unique identifier that the API provider will have linked to you. It is imperative for you to make sure that your API keys are not exposed to the rest of the world. What could go wrong? Well, that depends on what the APIs can do and what your keys have permissions to do.

What could happen if someone steal the payment processor API keys? I mean, I know for example that if someone steals your Google API keys he can use Google API charging it to my credit card (there are multiple cases all around the world), but in this case the API keys are used to process the payment, I don't understand what they can do with my API keys

When someone gets hold of your API keys, they can do whatever you can do with the APIs on your behalf. So for example, if they get hold of some credit cards, they can charge use the payment processor's APIs to make new credit card charges using your identity and defraud the card owners.

Where should I store my keys

You should store your keys at any place that can't be accessed by general users and is harder to access for anyone accessing your code. Often people use services like keyvaults (provided by all major cloud providers and some independent vendors like HashiCorp). Take a look at this blog post for PHP based examples.

When developing my own API should I use authentication no matter what I am going to do?, I mean, I know that authentication is for user login functionalities, but, should I use Auth to bring products from a database?

It is not mandatory for each API to have an authentication requirement. For example the service health endpoints are usually unauthenticated. It is your decision on which API requests should come only from authenticated/authorized users. If you think that anybody(regardless whether they are a user or not) should be able to view products from a database, then its okay to not authenticate the endpoint.

When you make an endpoint public, you should ensure that you don't end up adding some code path that allows users to view something without authenticating. For example, if you have scenarios where everyone can see the basic products but you need to have an account to view say the VIP products, then its your responsibility to ensure that your public endpoint doesn't have any way to show the VIP products.

When generating API keys for others to use my service, is it safe to store them in a database?

Whether it is safe to store them in a DB or not depends on your threat model. There is a risk of someone gaining access to your DB and as a result, getting access to the keys. If you encrypt the keys before storing them, then you reduce the risk a bit. There is actually an answer about this on stack overflow: https://stackoverflow.com/questions/37951220/storing-api-keys-on-server/37953361

4
  • Does auth protect from SQL injections too?, or It's just for protecting restricted actions inside the website – Ger Feb 18 at 18:08
  • 1
    @Ger No. Authentication is for a different purpose. Authenticated users can exploit SQL vulnerabilities as well. – Limit Feb 18 at 19:40
  • When generating API keys for others to use my service, is it safe to store them in a database? – Ger Feb 18 at 20:10
  • 1
    @Ger I updated my answer to that question! – Limit Feb 18 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.