2

For a project of mine, I need to know if I need to keep the API key secret or not. If I do, I'm not sure how I'm going to effect its protection, as Emacs Lisp files are stored in plain text (and byte-compiled files don't attempt/need to hide strings). Obviously, I want to avoid the key I was given for the mode to be abused by one and then suspended for everyone.

By API Key limit 10k is Per IP Address or Globally?, I'm assuming that the key will not drain globally for each individual use (per IP), but I can't assume the same principle holds for abuse.

Improve this question

1 Answer 1

Reset to default
3

The page where you can find the API key for your registered application says that the key doesn't need to be kept secret:

[The key] is not considered a secret, and may be safely embed [sic] in client side code or distributed binaries.

Abuse is typically an issue for the end-user, so you shouldn't be concerned about it beyond recognizing backoff responses and having your code react accordingly. It's unlikely the key itself would be blocked/revoked except in cases of extremely negligent design.

Improve this answer
1
  • Thanks for your response :) My concern then changes to the reality that the user can—if they wish—go in and edit the code. Would the token be suspended just for that IP, or will the API recognize that the token in itself is being abused?
    – Sean Allred
    Commented Nov 1, 2014 at 22:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .