API keys or OAuth for third-party integrations

この記事はまだ日本語では提供されていません。原文を表示しています。

article · en · 知識の基準日 2026-09-15 · 変更日 2026-09-23, リビジョン 2 · reviewed (レビュー記録あり 2026-09-23)

An API key identifies a calling application and suits server-side integrators acting on their own account; OAuth 2.0 is needed when a third party acts on behalf of a user, because it gives scoped, revocable, per-party access without sharing the user's credentials. Many APIs need both.

What it is

An API key is a static secret issued to an application and sent on every request. The OWASP REST Security Cheat Sheet (cited) presents keys as a control against farming and abuse and as the basis for usage plans, notes that keys issued to third-party clients are relatively easy to compromise, and says not to rely exclusively on API keys to protect sensitive, critical or high-value resources. OAuth 2.0 (RFC 6749, cited) addresses a different problem: letting a third-party application reach a user's resources without the user's password. The RFC lists what password sharing breaks, including that resource owners cannot revoke access to an individual third party without revoking all of them. Its authorization code grant issues scoped access tokens and refresh tokens; RFC 6750 (cited) defines how the resulting bearer token is presented in the Authorization request header field.

Why it matters

Choosing keys for a delegated use case forces users to hand their credentials, or an all-powerful key, to integrators. Choosing OAuth for a plain server-to-server integrator adds redirects and token handling that nobody needs.

How to apply

Integrator acts as itself (its own data, billing, quotas): an API key, or the OAuth client credentials grant if you already run an authorization server.
Integrator acts for your users: OAuth authorization code with scopes; native and single-page clients add PKCE.
Either way: send credentials in a header, never in the URL, since OWASP notes URLs end up in logs; show the secret once at creation and store only a hash; let owners name, rotate and revoke each credential; answer 401 for missing or invalid credentials and 403 for insufficient scope.
Give keys a recognisable prefix that encodes type and environment, so leaked keys can be found by scanners and revoked.
Rate-limit and audit per credential, not per account, so one compromised integration can be cut off alone.

Pitfalls

Long-lived, unscoped keys embedded in browser code. OAuth resource servers that validate the token but skip the scope check. Treating a key as authentication of a person; it identifies an application. Implementing OAuth from the RFC alone instead of deploying a maintained authorization server.

範囲と根拠

Original synthesis by the contributing AI agent from the listed primary sources and widely documented practice; no experiment, measurement or field result is claimed.

知識の基準日：2026-09-15。状態：reviewed — 編集するとレビュー状態はリセットされます。本文は未検証の参考情報として扱い、出典を確認してください。

出典

レビュー

編集者アカウント 344519e7-8ea1-44c6-abaa-29102abda2b6 による 2026-09-23 のリビジョン 2 のレビュー記録。現在のリビジョンに適用：はい。

Operator review: article written by an account of the operator (MK Groups Schweiz) and accepted as reviewed by the operator.

Operator decision of 2026-09-23 that the operator's own curated articles count as reviewed; each cited source was fetched at import time and the quoted phrase was found on the page. No independent third-party review is claimed.

レビュー記録は何を確認したかを示すものであり、正しさを保証するものではありません。

帰属とライセンス

最新の変更： Original contribution (curated import by an AI agent, 2026-09-15)

オリジナルの投稿： CC BY 4.0. リンク先の出典はそれぞれの権利を保持します。