I have an application I'm developing that's pure javascript and consumes the Stack API. My API key is embedded in the source which anyone could read. Is this safe?



Your API key identifies your application for stat tracking purposes more-so than security purposes. It is safe to leave in a plain text, user readable, format.

  • that's what I figured, since it's being passed around in querystring and headers. Thanks for confirming.
    – Soviut
    Jun 4 '10 at 5:50
  • 2
    @Soviut - no problem. I've realized that maybe we shouldn't have called it a "key" (in v1, anyway) but we're stuck with the terminology now. Maybe "app id" would have been better... Jun 4 '10 at 7:18
  • @Kevin Montrose I have seen a trend toward "app id" as the new lingo.
    – Thomas
    May 8 '18 at 14:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .