Unit 10.00: What an API key does and does not prove

An API key identifies a caller coarsely, and proves very little else.

One true claim out of five

What a valid key does and does not establish.

The code sorts five claims.

CLAIMS = [
    ("the caller holds a valid key",       True,  "that is what checking it proves"),
    ("the caller is who they say they are", False, "keys are shared and copied"),
    ("the request came from your frontend", False, "anything can send a header"),
    ("the key has not leaked",             False, "keys appear in logs and repos"),
    ("this caller may perform this action", False, "that is authorisation, separately"),
]
print(f"{'a valid API key proves...':40} {'true?':6} why")
for claim, true, why in CLAIMS:
    print(f"{claim:40} {str(true):6} {why}")

print("""
An API key identifies a CALLER, coarsely, and nothing else. It is appropriate
for server-to-server calls where you can rotate it and scope it.

It is not appropriate in a browser, where anyone can read it, and it is not a
substitute for the per-action check in the third unit of this module.
""")

The only thing it proves is that the caller holds a valid key. Keys are shared between systems, copied into configuration files, committed by accident and pasted into tickets - so possession is weak evidence of identity.

It is appropriate for server-to-server calls where you can scope and rotate it. It is not appropriate in a browser, where anyone can read it.

The mistake this prevents

The mistake is treating a key check as authorisation. It answers "is this a known caller?" and says nothing about whether that caller may perform this particular action, which is a separate check.

Takeaway

An API key identifies a caller and proves nothing about identity, origin or permission. It suits server-to-server calls and not browsers.

Mark complete