We are using an API from a third party for managing content which is secured by an API key which does not change over time. Now we are building our own API to support part of that functionality.

So the browser calls our API which is calling the 3rd party API using an API key. Should our API also have a key even though it is a publicly avaiable API? (The information we expose is not a secret)

I could think of securing that API because of scraping and that sort of things. What are best practices for APIs which retrieve content which unauthorized uses can als see?

1 Answer 1


According to: Open Web Application Security Project (OWASP, https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html) Best practices, which is used by many organisations:

If your Public REST service is without access control, it run the risk of being farmed leading to excessive compute cycles or bills for bandwidth. API keys can be used to mitigate this risk. They are also often used by organisation to monetize APIs; instead of blocking high-frequency calls, clients are given access in accordance to a purchased access plan.

API keys can reduce the impact of denial-of-service (DOS) attacks. However, when they are issued to third-party clients, they are relatively easy to compromise.

Require API keys for every request to the protected endpoint.
Return 429 Too Many Requests HTTP response code if requests are coming in too quickly.
Revoke the API key if the client violates the usage agreement.

Additional mesures complementary to API keys must also be considered if you have to to protect sensitive, critical or high-value resources.

CISOs or other relevant individuals have to assess the criticity of all the endpoints from a business perspective, because in many cases technical teams do not always grasp the business criticity of data.

Enforce access control on the coresponding API ressource endpoints is afterwards a possible option.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .