API key security in Javascript?

Question

I'm hosting a service which requires consumer to pass API key. It can be consumed by both server side (Ruby,Python etc) and client side applications using Javascript.

Is it possible to use the API key securely from a Javascript only app? I can't think of any way to achieve this at the moment

Cheekysoft · Accepted Answer · 2012-06-21 16:21:14Z

3

Not if the key is sensitive data.

All Javascript is visible to the users, so even an encrypted key could be decrypted. If the key must remain secret, it must never be used in any client-side code or content.

Communication of the key must be server to server, if the key needs to remain completely confidential. A javascript-heavy UI will still need to use a server as a intermediary to proxy calls to your service. A full javascript-only UI is not an option, unless the customer is willing to leak his service key to his users.

edited Jun 21, 2012 at 16:21

answered Jun 21, 2012 at 16:16

Cheekysoft

35.7k20 gold badges75 silver badges86 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

API key security in Javascript?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related