1. Never Hardcode API Keys
This seems obvious, but it's still the #1 cause of API key leaks. Hardcoded keys end up in:
- Git repositories (even private ones get exposed)
- Client-side JavaScript bundles
- Mobile app binaries (easily decompiled)
- Docker images and container logs
Best Practice: Use environment variables and secret management tools. Never commit keys to version control. Add .env to your .gitignore.
2. Use Different Keys for Different Environments
Production, staging, and development should each have their own API keys. If a development key leaks, your production data stays safe.
- Development - Limited access, test data only
- Staging - Production-like but isolated
- Production - Restricted access, full audit logging
3. Rotate Keys Regularly
Key rotation limits the damage if a key is compromised. Even if an attacker obtains a key, it becomes useless after rotation.
Implement a rotation schedule:
- High-security APIs - Rotate every 30-90 days
- Standard APIs - Rotate every 6 months
- Immediately - When an employee leaves or a breach is suspected
Pro Tip: Use a key management system that supports zero-downtime rotation. Issue a new key before revoking the old one.
4. Implement Rate Limiting
Rate limiting prevents abuse even with a valid key. Without limits, a compromised key can:
- Exhaust your API quotas
- Generate massive cloud bills
- Overload your infrastructure
- Scrape all your data
Set reasonable limits based on expected usage patterns. Monitor for anomalies that might indicate abuse.
5. Log and Monitor API Key Usage
You can't protect what you can't see. Comprehensive logging helps you:
- Detect unusual access patterns
- Identify compromised keys quickly
- Investigate security incidents
- Comply with audit requirements
Log the key identifier (not the full key), timestamp, endpoint, IP address, and response status. Set up alerts for suspicious activity.
6. Use Scoped Permissions
Not every key needs full access. Apply the principle of least privilege:
- Read-only keys - For analytics and reporting
- Write-limited keys - For specific operations
- Admin keys - Only for trusted systems, never in client apps
If a limited key is compromised, the attacker can only perform the actions that key allows.
7. Validate Keys Server-Side
Always validate API keys on your server, never trust client-side validation. Attackers can bypass client-side checks easily.
// Good: Server-side validation
const result = await holdify.verify(apiKey);
if (!result.valid) {
return res.status(401).json({ error: "Invalid API key" });
}
8. Set Expiration Dates
Keys that never expire are ticking time bombs. Set reasonable expiration dates:
Trial keys - 7-30 days
Standard keys - 1 year maximum
Temporary access - Hours or days
Send renewal reminders before expiration so legitimate users can refresh their keys.
9. Use HTTPS Everywhere
API keys sent over HTTP can be intercepted. Always:
Require HTTPS for all API endpoints
Send keys in headers, not URL parameters (URLs get logged)
Use TLS 1.2 or higher
Consider certificate pinning for mobile apps
10. Have an Incident Response Plan
Despite best practices, breaches happen. Be prepared:
Detection - Automated alerts for anomalies
Response - Process to immediately revoke compromised keys
Communication - Template for notifying affected users
Recovery - Steps to issue new keys and restore access
Practice your incident response. The middle of a breach is not the time to figure out your process.
Summary
API key security isn't optional. Following these 10 practices will significantly reduce your risk:
Never hardcode keys
Use environment-specific keys
Rotate keys regularly
Implement rate limiting
Log and monitor usage
Use scoped permissions
Validate server-side
Set expiration dates
Use HTTPS everywhere
Have an incident response plan
Want to skip building this yourself?
Holdify handles key generation, rotation, rate limiting, and monitoring out of the box. Focus on building your product, not security infrastructure.
👉 Start free at Holdify
What's your biggest API security challenge? Let me know in the comments!
Top comments (0)