🔐 How to Protect Your Public Express API Using API Keys

If you're building an API in Express.js and plan to expose it publicly — maybe to clients, third-party devs, or internal tools — you need some way to control access.

One of the most common and effective ways to do this is using API keys.

In this post, I’ll walk you through a simple way to implement API key protection in your Express API. No fancy gateways, no unnecessary bloat — just straightforward logic you can build on.

---

🚧 Why API Keys?

API keys are unique tokens (usually strings) that your users include in their requests. You can:

• Identify who's calling your API.
• Set limits (like 1,000 requests per day).
• Revoke keys if needed.
• Analyze usage by key/project/client.

Perfect for public or semi-public APIs that don’t need full OAuth complexity.

---

🛠️ Basic API Key Middleware in Express

Here’s a minimal implementation:

// middleware/apiKey.js
const validApiKeys = [
  'abc123', // In real use, store these in a DB
  'def456',
];

export function apiKeyMiddleware(req, res, next) {
  const apiKey = req.header('x-api-key');

  if (!apiKey || !validApiKeys.includes(apiKey)) {
    return res.status(401).json({ error: 'Unauthorized' });
  }

  next();
}

And in your Express app:

import express from 'express';
import { apiKeyMiddleware } from './middleware/apiKey.js';

const app = express();

app.use('/api', apiKeyMiddleware);

app.get('/api/data', (req, res) => {
  res.json({ message: 'Hello, world!' });
});

app.listen(3000, () => console.log('Server running on port 3000'));

---

🧠 A Few Tips

• Store API keys in a database (with metadata like usage, owner, status).
• Add rate limiting to prevent abuse.
• Consider rotating keys over time.
• Log each request to track usage per key.

---

⚡ Want to Skip the Boilerplate?

If you don’t want to build all this from scratch, you can use a tool like Limitly — it handles API key creation, validation, usage limits (daily, weekly, etc.), and request tracking with an SDK you can plug into your Express app.

I built it because I was tired of reinventing this every time I launched an API.

---

Let me know if you use a different method or have feedback — always happy to learn new approaches!