API key management in Prompt Engineering / GenAI - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why is it important to rotate API keys regularly?

Imagine you have an API key that allows access to a machine learning service. Why should you change (rotate) this key regularly?

A To increase the speed of API responses.

B To prevent unauthorized access if the key is leaked or stolen.

C To reduce the cost of using the API service.

D To make the API key longer and more complex.

💡 Hint

Think about what happens if someone else gets your key.

Rotating API keys regularly helps prevent unauthorized access if a key is leaked or stolen. It limits the time a compromised key can be used.

❓ Predict Output

intermediate

What is the output of this API key validation code?

Consider this Python code that checks if an API key is valid by length and prefix:

def is_valid_key(key):
    return key.startswith('sk-') and len(key) == 32

print(is_valid_key('sk-12345678901234567890123456789'))
print(is_valid_key('pk-12345678901234567890123456789'))
print(is_valid_key('sk-12345'))

What will be printed?

A

True
False
False

B

False
False
False

C

True
True
False

D

True
False
True

💡 Hint

Check the prefix and length conditions carefully.

The first key starts with 'sk-' and has length 32, so True. The second key starts with 'pk-', so False. The third key starts with 'sk-' but length is less than 32, so False.

❓ Model Choice

advanced

Which API key storage method is safest for a deployed ML model?

You deployed a machine learning model that calls an external API. Which method is safest to store the API key?

A Hardcoding the API key directly in the model's source code.

B Embedding the API key in client-side JavaScript code.

C Storing the API key in environment variables on the server.

D Saving the API key in a public GitHub repository.

💡 Hint

Think about who can access the stored key in each method.

Environment variables on the server keep the key hidden from users and source code, reducing risk. Hardcoding or public repos expose the key. Client-side code exposes it to anyone using the app.

❓ Hyperparameter

advanced

What is the effect of setting a very short API key expiration time?

Some API keys can be set to expire quickly (e.g., every 5 minutes). What is a likely effect of this setting?

A Has no effect on security or service availability.

B Reduces security because keys are reused more often.

C Increases API call speed by caching keys longer.

D Improves security by limiting key lifetime but may cause frequent service interruptions.

💡 Hint

Think about trade-offs between security and usability.

Short expiration improves security by limiting how long a stolen key works but may cause frequent re-authentication, leading to interruptions.

🔧 Debug

expert

Why does this API key check always fail?

Look at this Python code snippet that should check if an API key is valid:

def check_key(key):
    if key == 'sk-1234567890abcdef1234567890abcdef':
        return True
    else:
        return False

print(check_key('sk-1234567890abcdef1234567890abcdef '))

Why does the function return False even though the printed key looks the same?

A The input key has a trailing space, so it does not exactly match the stored key.

B The function uses '==' which cannot compare strings correctly.

C The print statement modifies the key before checking.

D The stored key is missing a character at the end.

💡 Hint

Check for invisible characters like spaces.

The input key has an extra space at the end, so the equality check fails. Strings must match exactly including spaces.

Practice

1. What is the main purpose of an API key in AI services?

easy

A. To improve AI model accuracy

B. To speed up the AI model training

C. To store user data securely

D. To control who can access the AI service

Solution

1. Step 1: Understand API key role

   An API key acts like a password to allow access to AI services.

2. Step 2: Identify main purpose

   It controls who can use the service by authenticating requests.

3. Final Answer:

   To control who can access the AI service -> Option D

4. Quick Check:

   API key = Access control [OK]

Hint: API keys are like secret passwords for access [OK]

Common Mistakes:

• Thinking API keys improve model accuracy
• Confusing API keys with data storage
• Believing API keys speed up training

2. Which of the following is the correct way to include an API key in a request header?

easy

A. Authorization: Bearer YOUR_API_KEY

B. API-Key: YOUR_API_KEY

C. Key: YOUR_API_KEY

D. Token: YOUR_API_KEY

Solution

1. Step 1: Recall standard header format

   The common standard is to use 'Authorization' with 'Bearer' followed by the API key.

2. Step 2: Match correct header syntax

   Authorization: Bearer YOUR_API_KEY matches this standard format exactly.

3. Final Answer:

   Authorization: Bearer YOUR_API_KEY -> Option A

4. Quick Check:

   Authorization header uses Bearer token [OK]

Hint: Use 'Authorization: Bearer' for API keys in headers [OK]

Common Mistakes:

• Using incorrect header names like 'Key' or 'Token'
• Omitting 'Bearer' keyword
• Placing API key in URL instead of header

3. Consider this Python code snippet using an API key:

import requests
headers = {"Authorization": "Bearer abc123"}
response = requests.get("https://api.example.com/data", headers=headers)
print(response.status_code)

What will this code print if the API key is valid and the request succeeds?

medium

A. 401

B. 200

C. 404

D. 500

Solution

1. Step 1: Understand HTTP status codes

   200 means success, 401 means unauthorized, 404 means not found, 500 means server error.

2. Step 2: Analyze code behavior with valid key

   With a valid API key, the request should succeed and return status code 200.

3. Final Answer:

   200 -> Option B

4. Quick Check:

   Valid key + successful request = 200 [OK]

Hint: 200 means success, 401 means unauthorized [OK]

Common Mistakes:

• Confusing 401 unauthorized with success
• Assuming 404 means invalid key
• Thinking 500 is related to API key

4. You have this code snippet to send a request with an API key:

headers = {"Authorization": "Bearer " + api_key}
response = requests.get(url, headers=headers)

But you get a 401 Unauthorized error. What is the most likely cause?

medium

A. The requests library is not imported

B. The URL is misspelled

C. The API key variable is empty or incorrect

D. The server is down

Solution

1. Step 1: Understand 401 error meaning

   401 Unauthorized means the server rejected the request due to bad or missing credentials.

2. Step 2: Identify cause related to API key

   If the API key variable is empty or wrong, the Authorization header is invalid, causing 401.

3. Final Answer:

   The API key variable is empty or incorrect -> Option C

4. Quick Check:

   401 error = invalid credentials [OK]

Hint: 401 means check your API key value first [OK]

Common Mistakes:

• Blaming URL spelling for 401 error
• Ignoring missing import errors
• Assuming server down causes 401

5. You want to improve security by rotating your API keys regularly. Which approach is best to avoid service interruption?

hard

A. Create a new key, update your app to use it, then delete the old key

B. Delete the old key first, then create a new key

C. Use the same key forever without changes

D. Share your API key publicly to get feedback

Solution

1. Step 1: Understand key rotation process

   To avoid downtime, keep old key active until new key is working.

2. Step 2: Choose safe rotation order

   Create new key, update app, confirm it works, then delete old key.

3. Final Answer:

   Create a new key, update your app to use it, then delete the old key -> Option A

4. Quick Check:

   Rotate keys safely by overlapping usage [OK]

Hint: Add new key before deleting old one [OK]

Common Mistakes:

• Deleting old key before new key is ready
• Never rotating keys at all
• Sharing keys publicly