I have an application I'm developing that's pure javascript and consumes the Stack API. My API key is embedded in the source which anyone could read. Is this safe?
Add a comment
|
1 Answer
Yes.
Your API key identifies your application for stat tracking purposes more-so than security purposes. It is safe to leave in a plain text, user readable, format.
-
that's what I figured, since it's being passed around in querystring and headers. Thanks for confirming.Soviut– Soviut2010-06-04 05:50:25 +00:00Commented Jun 4, 2010 at 5:50
-
2@Soviut - no problem. I've realized that maybe we shouldn't have called it a "key" (in v1, anyway) but we're stuck with the terminology now. Maybe "app id" would have been better...Kevin Montrose– Kevin Montrose2010-06-04 07:18:33 +00:00Commented Jun 4, 2010 at 7:18
-
@Kevin Montrose I have seen a trend toward "app id" as the new lingo.Thomas– Thomas2018-05-08 14:05:37 +00:00Commented May 8, 2018 at 14:05