An API key is a unique secret string that one service places in a request so another service can identify and authorize it. A payment processor may require a key to verify that a charge request comes from the shopping application; if the key leaks, an attacker can cause financial damage. section 2.2 section 16.2.2
The usual pattern is simple: generate a key, configure the calling service with it, send it in an HTTP or message header, and reject requests whose key is missing or unrecognized. This simplicity makes API keys useful for small internal systems, but it also creates a fragile trust boundary. section 3.1.2 section 16.2.2
Validating a request
A billing service might receive `X-API-KEY: abc123-secure-token`. Application logic compares the supplied value with the expected key and returns HTTP 401 Unauthorized when they differ. In production, validation should be extracted from individual controllers so the rule is not duplicated. section 16.2.2
Treat an API key as a sensitive credential:
- Store it in a centralized credential service rather than ordinary configuration files, which are difficult to secure, audit, synchronize, and rotate across production servers. section 2.2 section 2.4
- Rotate it deliberately; static keys otherwise remain valid until someone changes them. section 2.2 section 16.2.2
- Protect requests with HTTPS or mTLS, because a spoofable header is not sufficient protection on an exposed or compromised network. section 16.2.2 section 3.1.2
- Prefer OAuth2 client credentials or mTLS when stronger identity, lifecycle management, or request context is needed. section 16.2 section 16.4
Figure 2.8 A credential vault is a centralized store of sensitive configuration values, such as passwords, API keys, digital certificates, and other secrets the application needs at run time.
A credential vault illustrates where API keys can live alongside passwords, certificates, and other runtime secrets. section 2.2
