Stack Apps is a question and answer site for apps, scripts, and development with the Stack Exchange API. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an application I'm developing that's pure javascript and consumes the Stack API. My API key is embedded in the source which anyone could read. Is this safe?

share|improve this question
up vote 6 down vote accepted


Your API key identifies your application for stat tracking purposes more-so than security purposes. It is safe to leave in a plain text, user readable, format.

share|improve this answer
that's what I figured, since it's being passed around in querystring and headers. Thanks for confirming. – Soviut Jun 4 '10 at 5:50
@Soviut - no problem. I've realized that maybe we shouldn't have called it a "key" (in v1, anyway) but we're stuck with the terminology now. Maybe "app id" would have been better... – Kevin Montrose Jun 4 '10 at 7:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .