Google Analytics API Key Security

Question

When dealing with an API key (in this case a JSON file used to connect to the Google Analytics API), what is the appropriate way to securely store the keyfile?

"Your new public/private key pair is generated and downloaded to your machine; it serves as the only copy of this key. You are responsible for storing it securely."

Is the idea here that only specific user groups should have access to the API key? Say an administrator? Or if I have this on my server is that acceptable?

• Stack Exchange Broke The Law: Tell me: What does the API key do?
• Sean Payne: The API key is used to identify that I am an authorized user when connecting to Google Analytics.
• Stack Exchange Broke The Law: What would happen if someone else got the API key? And do you need the API key to do things that the server needs to do?
• Sean Payne: If someone also had the view ID, which is the unique identifier for the client, then they could pull analytics from the client's data. However, I have an easier time of keeping the view id less (easily) accessible since it will be stored in a database. To elaborate on the use case, this is for a dashboard which many clients will access and check their analytics. As far as what the server needs to do, it needs to pull these analytics on a monthly basis and store them in a database. I would imagine that this is more secure on the server side, rather than the client side.

Answer 1

You would typically treat API keys as a secret and store them appropriately. Generally this means using some sort of encrypted store (think of a password manager for applications) that integrates with your application deployment process or runtime. Some examples would be HashiCorp Vault, Azure Key Vault or the Kubernetes Secrets (https://kubernetes.io/docs/concepts/configuration/secret/) integration.