Best Practices for Using API Keys
General guidelines for managing and using API keys safely
API keys are required for apps and projects that use Plex APIs. Secure your API keys when you create them for maximum security.
It’s possible to secure API keys after they’re created and in use, but there can be different constraints based on how the key is used. Protect against unauthorized access by selecting the products it’s used for and regularly replacing keys.
The best time to secure your API keys is when you first create them. Retroactively applying restrictions may require updating existing applications.
Key security practices
- Restrict API Keys — Limit keys to only the APIs they need access to and set expiration dates
- Restrict Developer Portal Account Access — Control who can create and manage API keys
- Regularly Audit Your API Keys — Review key usage and permissions on a regular cadence
- Use Independent API Keys for Different Apps — Isolate access per application for better security
- Regenerate API Keys Regularly — Rotate keys to minimize the impact of compromised credentials
- Store API Keys in a Secure Location — Never hardcode keys in source files
- Encrypt Keys on Code Repositories — Use encryption and secrets management for stored keys