0

I'm building a phpapi and in this api will be giving my clients API key generated for each client.

So basically my client will be sending client id, his personal data(to be stored in DB) & an API key to my api.php page and this API key will be placed in a hidden field on clients form.

Now my doubt here is that this key can be seen by anyone if they view page source...
So how can I prevent key from being not seen so that no other clients can use it for them.
OR
Is there any other way to place API key on form so it cannot be seen and use securely?

Improve this question

1 Answer 1

Reset to default
2

Anything transferred to the client and used by the client is inherently insecure.

That being said, the API key can safely be divulged to the client. The only thing you need to protect is the client secret - which is only used in the explicit authentication flow.

More details here: https://api.stackexchange.com/docs/authentication

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .