API Keys and Secure Access

# CHAPTER 5

API Keys and Secure Access #

1. Introduction #

2. Learning Objectives #

• Understand the primary use cases for API Keys versus User Tokens.

• Design a secure database architecture to store and validate API Keys.

• Implement API Key validation via HTTP Headers in PHP.

• Understand the critical danger of committing API keys to Git repositories.

• Explain the concept and necessity of API Key Rotation.

3. Beginner-Friendly Explanation #

• User Authentication is like a human security guard. You roll down your window, show your driver's license, and they verify your face.

• An API Key is like an electronic toll pass (EZ-Pass) stuck to your windshield. The garage gate scans it wirelessly and opens instantly. It’s designed for fast, automated, machine-to-machine verification.

If someone steals the physical EZ-Pass from your car, they can enter the garage and the system will charge *your* account. Therefore, keeping that EZ-Pass (the API Key) a tightly guarded secret is the most important part of system-to-system security.

4. Real-World Attack Scenarios #

• The GitHub Scraping Disaster: A junior developer accidentally uploads their code to a public GitHub repository. They forgot to remove their AWSAPIKEY from the code. Within 5 minutes, an automated bot scrapes GitHub, finds the key, and uses it to spin up hundreds of servers to mine cryptocurrency. The developer's company is billed $50,000 overnight.

• The Mobile App Extraction: A developer hardcodes a Google Maps API Key directly into their Android App's source code. A hacker reverse-engineers the app, extracts the key, and uses it for their own commercial application, exhausting the original developer's quota.

5. Security Examples (Generating a Key) #

<?php
// Generates a secure, 64-character random hexadecimal API key
$api_key = bin2hex(random_bytes(32)); 
echo "Your new API Key is: " . $api_key;
?>

6. Vulnerable vs Secure Code Examples (Validating Keys) #

Vulnerable API (Key in URL, vulnerable to timing attacks):

<?php
// NEVER pass keys in the URL query string! They get logged in server access logs.
$client_key = $_GET[&#039;api_key'];
$valid_key = "secret_12345";

// '==' is vulnerable to Timing Attacks (hackers can guess the key letter by letter based on how long the comparison takes)
if ($client_key == $valid_key) {
    echo "Access Granted";
}
?>

Secure API (Key in Header, Time-safe comparison):

<?php
// Always expect keys in the HTTP Headers
$headers = apache_request_headers();
$client_key = $headers[&#039;X-API-KEY'] ?? '';

// Fetch the hashed key from the database for this specific client...
$db_hash = fetch_key_hash_from_db();

// Use password_verify to check the hash securely and prevent timing attacks
if (password_verify($client_key, $db_hash)) {
    echo json_encode(["data" => "Secure data granted."]);
} else {
    http_response_code(401);
    echo json_encode(["error" => "Invalid API Key"]);
}
?>

7. HTTP Examples #

GET /api/v1/weather?city=London HTTP/1.1
Host: api.weather.com
X-API-KEY: a1b2c3d4e5f6g7h8i9j0

8. Database Architecture #

• When the user generates a key, show it to them *once*.

• Hash the key using passwordhash() and store the hash in the database.

• Q: Why must you use passwordverify or hash_equals instead of == when comparing an API key in PHP? *(Answer: To prevent Timing Attacks).*

17. FAQs #

18. Summary #

19. Next Chapter Recommendation #