How do API Keys and Secret Keys work?

Posted by viatropos on Stack Overflow See other posts from Stack Overflow or by viatropos
Published on 2010-04-20T10:57:29Z Indexed on 2010/04/20 11:23 UTC
Read the original article Hit count: 283

Filed under:

api-key

|

passwords

|

security

I am just starting to think about how api keys and secret keys work. Just 2 days ago I signed up for Amazon S3 and installed the S3Fox Plugin. They asked me for both my Access Key and Secret Access Key, both of which require me to login to access.

So I'm wondering, if they're asking me for my secret key, they must be storing it somewhere right? Isn't that basically the same thing as asking me for my credit card numbers or password and storing that in their own database?

How are secret keys and api keys supposed to work? How secret do they need to be? Are these applications that use the secret keys storing it somehow?

Thanks for the insight.

© Stack Overflow or respective owner

Related posts about api-key

Google Maps API Key alert problem

as seen on Stack Overflow - Search for 'Stack Overflow'
I have a problem with my Google Maps API key. I get an alert saying "This web site needs a different Google Maps API key." When I prees OK to the alert the map are loading and working fine. The same problem is already posted: http://stackoverflow.com/questions/1803327/google-maps-api-key-not-working I… >>> More
get information from cleartrip.com using api key in java

as seen on Stack Overflow - Search for 'Stack Overflow'
i want to get information about hotels, flight and train from http://cleartrip.com. i have registered there and get api key... i put all information in program for getting hotel details... but i get 401 error... i use this link for getting api key and all information http://www.cleartrip.com/api/index… >>> More
Rails plugin for API Key + Secret Key signing

as seen on Stack Overflow - Search for 'Stack Overflow'
Is there a Rails plugin or a rubygem that gives you a starting point for adding an api to your Rails app? We want to use the API Key/Secret Key model, the API should also be versionable. Is there something out there that will give us some, if not all of this? >>> More
I have lost my Google map API key.

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, I have lost my google API key. I am not having email address which which I had subscribed for google map API. Please tell me how do I get google API key for my domain again? >>> More
Google Maps 'API key' problem

as seen on Stack Overflow - Search for 'Stack Overflow'
I finally got this google maps page working however, it seems that everybody except the client can see it? They're saying the following error message appears "This web site needs a different Google Maps API key. A new key can be generated at..." Here's the page: http://www.sportingemporium.com/google-map… >>> More

Related posts about passwords

Fixing /etc/shadow with md5 passwords to sha512 passwords

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I recently upgraded an ubuntu server with many users to a recent version from a version from 2008. The server used to use md5 password hashes (e.g., the shadow passwords began with $1$) and now is configured to use sha512. I'd prefer to keep using sha512, but would like the old users to be able… >>> More
How to securely generate memorable passwords?

as seen on Super User - Search for 'Super User'
Whenever I need new passwords I use some tools to generate those, preferable memorable passwords, but I've been wondering how secure this might actually be. Using The xkcd random number generator is probably pretty bad, cat /dev/random is probably pretty good, but generating memorable passwords seems… >>> More
Gawker Passwords

as seen on Geeks with Blogs - Search for 'Geeks with Blogs'
There has been much news about the hack of the Gawker web sites. There has even been an analysis of the common passwords found. This list is embarrassing in many ways. The most common password was "123456". The second most common password was "password". Much has also been written providing… >>> More
Phishing Ploy Forces Twitter to Reset Passwords

as seen on Internet.com - Search for 'Internet.com'
The microblogging site has reset some Twitter users' passwords after a phishing attack attempted to steal their login information. >>> More
Phishing Ploy Forces Twitter to Reset Passwords

as seen on Internet.com - Search for 'Internet.com'
The microblogging site has reset some Twitter users' passwords after a phishing attack attempted to steal their login information. >>> More