Securing an API key in a web extension

Question

I'm building a web extension that will be a wrapper for a public API. There aren't any paid tiers for the API currently, but I'm trying to secure the API key so it doesn't get stolen and used outside of my app. I'd like to avoid having my permissions denied.

I currently have 2 ideas that would allow me to do such a thing:

1. Have the API key in plaintext in the web extension and hope that people are nice enough to not steal it using CRX Viewer (unlikely).

2. Proxy all API requests through a web server and append the API key server side, returning the results from the API via my proxy to the client.

I'm a fan of Node.js and would like to pursue number 2. How do I go about securing my API in Node.js so that people can't just reroute their requests through my server to the API instead of directly to the API with a stolen key?

• Berin Loritsch: One solution for this is to set up environment variables that has the info. Your code only looks it up. AWS and other providers allow you to have some control for this purpose.
• James Gould: @BerinLoritsch my concern is a user would then route their queries through mysite.com/api/something rather than theactualapi.com/api, using an environment variable would still expose my API key to queries outside of my application.
• Berin Loritsch: Only if you have multiple applications on the same box--which is usually frowned upon. App containers (like docker) can help contain the scope of your environment variable and give you the effect of one app per container and the flexibility of deploying them however you like.
• JimmyJames: It's not clear whether you want to have other people using your API keys via your solution as a proxy. You don't really specify what the API is that you are using but doing that violates the terms of a lot of service agreements.
• Robert Harvey: google.com/search?q=node.js+securing+your+api

Answer 1

If you have to limit the usage of your key, you have to limit the usage of your proxy.

The typical way if to have users sign up (passing some captcha to prevent naive robots from mass-registering), and issuing a token per user. A server only serves a bearer of a valid token. You can throttle usage per token, or even revoke and ban leaked and abused tokens.

This does make onboarding harder, and adoption lower.

Of course, ideally every user could just obtain their own API key, paste it into a settings box of your extension, and rid you of the necessity to run a proxy server. If this is even feasible, I'd explore this way first.

Answer 2

If I don't misunderstand the question, one simple approach to this would be to pass your API key to the wrapper when you use it over a secure channel. As you note, by putting the key in the server, you haven't really solved anything you still need to secure the server. If you require the key to be specified upon usage of the web extension, you also make this web extension usable by others.