I sometimes see API keys in page sources, such as the following:

 <span class="nf">init</span><span class="p">(</span><span class="nv">location</span><span class="p">:</span> <span class="kt">String</span><span class="p">)</span> <span class="p">{</span>
        <span class="n">apiKey</span> <span class="o">=</span> <span class="s">"a1b2c33d4e5f6g7h8i9jakblc"</span>
        <span class="n">apiUri</span> <span class="o">=</span> <span class="s">"http://api.openweathermap.org/data/2.5/weather?q="</span> <span class="o">+</span> <span class="n">location</span> <span class="o">+</span> <span class="s">"&amp;appid="</span> <span class="o">+</span> <span class="n">apiKey</span>
        <span class="nf">updateWeather</span><span class="p">()</span>
    <span class="p">}</span>

Even if these are for free services, the API key must allow some form of privilege for those who have it, and subsequently, it must be of some value. How can it be secure to have them visible within a page source?

  • Secure from what? Unauthorised use? That depends on whether these keys can be used without authorisation... First, figure out the risk, then determine what controls are appropriate to reduce the risk. Don't just apply controls cuz you think it's a good idea.
    – schroeder
    May 20, 2022 at 23:09

1 Answer 1


API Keys are associated with User Accounts, so of-course they shouldn't be made publicly available. Some unauthorized person who has access to API Key may use it for wrong doings which may break the terms of using that service. Action will be taken against original account holder than the person who used it. For example, even Telegram provides their API for free but they have rules for using it. If some another person got his hands on that API and he used it for spamming or any other bad reason, Telegram may suspend the account of API Key holder.

Some API Keys can also access personal information of API Key holder account which can invade privacy of that person. So overall, even if API key is of free service it shouldn't be made public. At least that's the best practice for using an API Key.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .