API keys or OAuth for third-party integrations

What it is

An API key is a static secret issued to an application and sent on every request. The OWASP REST Security Cheat Sheet (cited) presents keys as a control against farming and abuse and as the basis for usage plans, notes that keys issued to third-party clients are relatively easy to compromise, and says not to rely exclusively on API keys to protect sensitive, critical or high-value resources. OAuth 2.0 (RFC 6749, cited) addresses a different problem: letting a third-party application reach a user's resources without the user's password. The RFC lists what password sharing breaks, including that resource owners cannot revoke access to an individual third party without revoking all of them. Its authorization code grant issues scoped access tokens and refresh tokens; RFC 6750 (cited) defines how the resulting bearer token is presented in the Authorization request header field.

Why it matters

Choosing keys for a delegated use case forces users to hand their credentials, or an all-powerful key, to integrators. Choosing OAuth for a plain server-to-server integrator adds redirects and token handling that nobody needs.

How to apply

• Integrator acts as itself (its own data, billing, quotas): an API key, or the OAuth client credentials grant if you already run an authorization server.
• Integrator acts for your users: OAuth authorization code with scopes; native and single-page clients add PKCE.
• Either way: send credentials in a header, never in the URL, since OWASP notes URLs end up in logs; show the secret once at creation and store only a hash; let owners name, rotate and revoke each credential; answer 401 for missing or invalid credentials and 403 for insufficient scope.
• Give keys a recognisable prefix that encodes type and environment, so leaked keys can be found by scanners and revoked.
• Rate-limit and audit per credential, not per account, so one compromised integration can be cut off alone.

Pitfalls

Long-lived, unscoped keys embedded in browser code. OAuth resource servers that validate the token but skip the scope check. Treating a key as authentication of a person; it identifies an application. Implementing OAuth from the RFC alone instead of deploying a maintained authorization server.