Restrict API Keys
When you first create your API keys, apply API restrictions so they run only on specific APIs. You must have a valid API key to use an API. Limit the usage of API keys to only the necessary APIs — you can specify as many APIs as required.
Set expiration dates
When creating or editing an API key, you can set the key to expire after a certain amount of time. This helps prevent unauthorized access by ensuring the API key does not persist longer than needed.
After a key expires, you must reset the expiration date or create a new key. Plan your key rotation strategy to avoid service disruptions.
Apply restrictions to all keys
Make sure all your API keys have API restrictions and expiration dates. If you have insecure API keys, create new ones with the appropriate security measures and update all your apps with the new API keys.
One key per application provides the most security. You can use a key on multiple apps if the restrictions on the key don’t cause incompatibility issues with the other apps using that key.
Restricting existing API keys
When restricting existing API keys by editing apps, make sure the restrictions don’t break any of your existing applications. Before applying new restrictions:
- Review which apps are currently using the key
- Verify the key’s current permissions match the app’s requirements
- Test your applications after applying restrictions to confirm they still function correctly