I have an application I'm developing that's pure javascript and consumes the Stack API. My API key is embedded in the source which anyone could read. Is this safe?



Your API key identifies your application for stat tracking purposes more-so than security purposes. It is safe to leave in a plain text, user readable, format.

| improve this answer | |
  • that's what I figured, since it's being passed around in querystring and headers. Thanks for confirming. – Soviut Jun 4 '10 at 5:50
  • 2
    @Soviut - no problem. I've realized that maybe we shouldn't have called it a "key" (in v1, anyway) but we're stuck with the terminology now. Maybe "app id" would have been better... – Kevin Montrose Jun 4 '10 at 7:18
  • @Kevin Montrose I have seen a trend toward "app id" as the new lingo. – Thomas May 8 '18 at 14:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .