The REST API Design Handbook

by George Reese

API keys are similar to user names and passwords in that they consist of a public access key that identifies the system interacting with the API and a shared secret between the consuming system and the API provider. API keys have a number of advantages. First, they can be much stronger than a user name/password since no one has to remember them. Typically, API keys are long random strings like an access key of FMKPVBVBCKUZJETXXRVP with a secret key of C5eTeKuXtnibcfm+LNYsIiMsSaaQ6xAFTpQtH0kW. The second advantage to API keys is that they don’t identify users; they identify systems optionally acting on behalf of a user. In practice, this means that for each third-party system you want to interact with an API, you can have separate keys instead of sharing a single user name/password combination. Consequently, you can expire the keys for one external system without impacting any of the others. You also end up with traceability to a specific third-party should things go badly.