API keys are best suited for which scenario?

API keys are best suited for which scenario?

• A. User-facing login credentials
• B. Server-to-server communication and third-party access
• C. Short-lived UI tokens
• D. Browser cookies

Answer: (B)

API keys are a simple shared secret that identifies the calling project or client to an API. They’re best when the caller is a server or service that can securely store the key and use it to access APIs on behalf of that application. This makes them ideal for server-to-server communication and for third-party access where the key can be kept out of users’ hands and tied to a specific project or app. They’re not well-suited for user-facing login credentials because a single key would be shared with end users, making it hard to attribute actions to a real person and easy to leak. Short-lived UI tokens are typically short-lived and scoped per user or per session, while API keys are usually long-lived and not designed for per-session rotation. Browser cookies are exposed to the client environment, so placing a secret API key in a browser is insecure; cookies are meant for session management, not for securely authenticating API calls with a secret key. So the best fit is server-to-server communication and third-party access where the key can be kept secure and used to identify the calling application rather than an individual user.

API keys are a simple shared secret that identifies the calling project or client to an API. They’re best when the caller is a server or service that can securely store the key and use it to access APIs on behalf of that application. This makes them ideal for server-to-server communication and for third-party access where the key can be kept out of users’ hands and tied to a specific project or app.

They’re not well-suited for user-facing login credentials because a single key would be shared with end users, making it hard to attribute actions to a real person and easy to leak. Short-lived UI tokens are typically short-lived and scoped per user or per session, while API keys are usually long-lived and not designed for per-session rotation. Browser cookies are exposed to the client environment, so placing a secret API key in a browser is insecure; cookies are meant for session management, not for securely authenticating API calls with a secret key.

So the best fit is server-to-server communication and third-party access where the key can be kept secure and used to identify the calling application rather than an individual user.