API key management in Prompt Engineering / GenAI - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is an API key?

An API key is a unique code passed by a client to an API to identify and authenticate the client making the request.

beginner

Why should API keys be kept secret?

API keys grant access to services and data. If exposed, unauthorized users can misuse the API, causing security risks and extra costs.

intermediate

What is the purpose of rotating API keys?

Rotating API keys means regularly changing them to reduce the risk of misuse if a key is compromised.

intermediate

How can you restrict API key usage?

You can restrict API keys by limiting IP addresses, setting usage quotas, or defining allowed API endpoints to improve security.

advanced

What is the difference between API key and OAuth token?

An API key is a simple static token for identification, while an OAuth token is a dynamic token that provides delegated access with user permissions.

What is the main role of an API key?

A Encrypt data between client and server

B Store user passwords

C Identify and authenticate the client

D Generate machine learning models

API keys are used to identify and authenticate clients making API requests.

Which practice helps protect API keys from misuse?

A Rotating keys regularly

B Sharing keys publicly

C Using the same key forever

D Ignoring usage limits

Regularly rotating API keys reduces the risk if a key is compromised.

How can API key usage be restricted?

A By using more keys

B By increasing key length

C By disabling encryption

D By limiting IP addresses

Restricting API keys by IP addresses limits where the key can be used.

What happens if an API key is exposed publicly?

A Unauthorized users can misuse the API

B The API key becomes stronger

C The API key automatically changes

D Nothing happens

Exposed API keys can be used by unauthorized users, causing security risks.

Which is a key difference between API keys and OAuth tokens?

A API keys expire every minute; OAuth tokens never expire

B API keys are static; OAuth tokens are dynamic

C OAuth tokens are used only for databases

D API keys require user passwords

API keys are static tokens, while OAuth tokens are dynamic and provide delegated access.

Explain why managing API keys carefully is important for security.

Think about what happens if someone else gets your key.

Describe methods to restrict API key usage to improve security.

Consider how to limit where and how keys are used.