We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design Masterclass · Api Design Protocols
Free preview: the first 2 parts of this 8-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Api Design Protocols
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
You want to use Google Maps in your app. Google doesn't just let anyone hit their API for free, unlimited. They need to know who's calling, how much they're using, and whether they should be allowed at all. The simplest way to do this? Give you a unique string, an API key, and require you to include it in every request.
API keys are the building keycards of the API world. They don't prove who you are the way a password does (that's authentication). They identify which application or organization is making the request. Google doesn't care that "Roni" is calling the Maps API, they care that "Roni's delivery tracking app" is calling it, and that it hasn't exceeded its 10,000 requests/day quota.
Every major API uses keys: Google, Stripe, Twilio, OpenAI, AWS. They're the first layer of API security, not because they're the strongest, but because they're the simplest to implement, the easiest for developers to use, and sufficient for identifying consumers and enforcing usage limits.
An API key is a long, random string generated by the API provider and given to the consumer. The consumer includes it in every request:
As a header (recommended):
GET /api/v1/geocode?address=Delhi
Authorization: Bearer sk_live_abc123xyz
As a query parameter (not recommended, keys appear in server logs and browser history):
GET /api/v1/geocode?address=Delhi&api_key=sk_live_abc123xyz
The server receives the request, extracts the key, and:
Key types by convention (Stripe popularized this):
| Prefix | Meaning | Example |
|---|---|---|
pk_live_ | Publishable key (safe for frontend) | Payment form initialization |
sk_live_ | Secret key (server only) | Charging cards, reading data |
pk_test_ | Publishable test key | Sandbox/test mode |
sk_test_ | Secret test key | Sandbox/test mode |
API keys are NOT passwords. They don't authenticate a user. They identify an application. An API key says "this request is from App X." It doesn't say "this request is from User Y of App X." For user-level authentication, you need , JWTs, or session tokens.