API key management in Microservices - System Design Guide

Problem Statement

Without proper API key management, unauthorized users can access services, leading to data breaches and service misuse. Additionally, lack of control over API keys makes it hard to revoke or rotate keys, causing security risks and operational challenges.

Solution

API key management controls access by issuing unique keys to clients and validating them on each request. It includes generating, storing, rotating, and revoking keys securely, often integrated with authentication and authorization systems to enforce usage policies.

Architecture

Client App

→API Gateway

↓

This diagram shows a client sending requests with an API key to the API Gateway, which validates the key against a Key Database before forwarding the request to microservices.

Trade-offs

✓ Pros

→

Prevents unauthorized access by validating API keys on every request.

→

Allows fine-grained control over client permissions and usage limits.

→

Supports key rotation and revocation to maintain security over time.

→

Enables monitoring and auditing of API usage per client.

✗ Cons

→

Adds latency due to key validation on each request.

→

Requires secure storage and management of keys to prevent leaks.

→

Increases system complexity with additional components like key databases and gateways.

Use when your system exposes APIs to external or internal clients requiring controlled access, especially at scale above 1,000 requests per second or when security and usage tracking are critical.

Avoid if your API is strictly internal with trusted clients and low security risk, or if the request volume is very low (under 100 requests per day) where overhead outweighs benefits.

Real World Examples

Stripe

Stripe issues API keys to merchants to securely access payment processing APIs, enabling fine-grained control and easy revocation if keys are compromised.

Google Cloud

Google Cloud uses API keys to authenticate and authorize access to its cloud services, allowing usage tracking and quota enforcement per client.

Twilio

Twilio manages API keys to control access to its communication APIs, enabling clients to rotate keys regularly and revoke compromised keys without service disruption.

Code Example

The before code exposes an endpoint without any access control. The after code adds a decorator that checks for a valid API key in the request headers and rejects unauthorized requests with a 401 error.

Microservices

### Before: No API key validation
from flask import Flask, request
app = Flask(__name__)

@app.route('/data')
def data():
    return {'message': 'Public data'}


### After: API key validation middleware
from flask import Flask, request, abort
app = Flask(__name__)

VALID_API_KEYS = {'abc123', 'def456'}

def require_api_key(func):
    def wrapper(*args, **kwargs):
        api_key = request.headers.get('X-API-Key')
        if api_key not in VALID_API_KEYS:
            abort(401, 'Invalid or missing API key')
        return func(*args, **kwargs)
    return wrapper

@app.route('/data')
@require_api_key
def data():
    return {'message': 'Protected data'}

Alternatives

OAuth 2.0

Uses token-based authorization with scopes and user consent instead of static API keys.

Use when: Choose OAuth 2.0 when user delegation and fine-grained permission scopes are required.

Mutual TLS Authentication

Clients authenticate using certificates instead of keys, providing stronger identity verification.

Use when: Choose mutual TLS when high security and encrypted client-server communication are mandatory.

JWT (JSON Web Tokens)

Uses signed tokens carrying claims instead of opaque API keys, enabling stateless authentication.

Use when: Choose JWT when you want scalable, stateless authentication with embedded user information.

Summary

API key management prevents unauthorized API access by validating unique keys per client.

It enables control over usage, key rotation, and revocation to maintain security.

Proper management requires secure storage, validation, and integration with API gateways.

Practice

1. What is the primary purpose of API key management in microservices?

easy

A. To generate random data for APIs

B. To speed up API response times

C. To store user passwords securely

D. To control and monitor access to APIs

Solution

1. Step 1: Understand API key management role

   API key management is about controlling who can use APIs and tracking their usage.

2. Step 2: Identify the main goal

   The main goal is to secure APIs by controlling and monitoring access, not speeding up or storing passwords.

3. Final Answer:

   To control and monitor access to APIs -> Option D

4. Quick Check:

   API key management = Access control [OK]

Hint: API keys control who uses your API [OK]

Common Mistakes:

• Confusing API keys with password storage
• Thinking API keys improve speed
• Assuming API keys generate data

2. Which of the following is the correct way to represent an API key in a request header?

easy

A. Auth-Key: <API_KEY>

B. Authorization: Bearer <API_KEY>

C. API-Key: <API_KEY>

D. Key: <API_KEY>

Solution

1. Step 1: Review common API key header formats

   API keys are often sent in headers named API-Key or similar, but Authorization: Bearer is usually for tokens, not API keys.

2. Step 2: Identify the standard header for API keys

   API-Key is the widely accepted header for API keys, making API-Key: <API_KEY> correct.

3. Final Answer:

   API-Key: <API_KEY> -> Option C

4. Quick Check:

   API key header = API-Key [OK]

Hint: API keys use 'API-Key' header, not 'Authorization: Bearer' [OK]

Common Mistakes:

• Using 'Authorization: Bearer' for API keys
• Confusing header names
• Omitting the key value

3. Given this pseudocode for API key validation:

function validateKey(request) {
  key = request.headers['API-Key']
  if key is null or key not in validKeys:
    return 'Access Denied'
  else:
    return 'Access Granted'
}

What will be the output if the request has no 'API-Key' header?

medium

A. Access Denied

B. Error: Missing header

C. Access Granted

D. Access Pending

Solution

1. Step 1: Check header presence condition

   The code checks if the key is null or not in validKeys. If the header is missing, key is null.

2. Step 2: Determine the return value for missing key

   Since key is null, the condition is true, so the function returns 'Access Denied'.

3. Final Answer:

   Access Denied -> Option A

4. Quick Check:

   Missing key = Access Denied [OK]

Hint: No API-Key header means deny access [OK]

Common Mistakes:

• Assuming missing key grants access
• Expecting an error instead of denial
• Confusing 'null' with empty string

4. A developer wrote this code snippet to revoke an API key:

function revokeKey(key) {
  if key in activeKeys:
    activeKeys.remove(key)
  else:
    print('Key not found')
}

But the key is still accepted after revocation. What is the likely issue?

medium

A. The remove method does not delete keys properly

B. The key is not removed from the validKeys list used for validation

C. The function does not print 'Key revoked' message

D. The key is being re-added automatically elsewhere

Solution

1. Step 1: Understand key revocation logic

   The function removes the key from activeKeys, but validation likely checks validKeys.

2. Step 2: Identify mismatch in key storage

   If validation uses validKeys and revoke removes from activeKeys, the key remains valid.

3. Final Answer:

   The key is not removed from the validKeys list used for validation -> Option B

4. Quick Check:

   Revocation must remove key from validation list [OK]

Hint: Revoking must remove key from validation store [OK]

Common Mistakes:

• Removing key from wrong list
• Assuming print messages affect logic
• Ignoring other code re-adding keys

5. You need to design an API key management system for a microservices platform that supports millions of users. Which approach best balances security, scalability, and ease of revocation?

hard

A. Store API keys in a centralized database with caching and use short-lived keys with rotation

B. Embed API keys directly in client apps without server validation

C. Use a single global API key for all users to simplify management

D. Store API keys only in memory on each microservice without persistence

Solution

1. Step 1: Evaluate security and scalability needs

   Millions of users require scalable storage and fast validation. Centralized DB with caching supports this.

2. Step 2: Consider revocation and key rotation

   Short-lived keys with rotation improve security and allow easy revocation without downtime.

3. Step 3: Eliminate insecure or unscalable options

   Embedding keys in clients or using a single key is insecure; in-memory only storage lacks persistence and scalability.

4. Final Answer:

   Store API keys in a centralized database with caching and use short-lived keys with rotation -> Option A

5. Quick Check:

   Central DB + caching + rotation = secure & scalable [OK]

Hint: Use central DB with caching and rotate keys regularly [OK]

Common Mistakes:

• Using single global key for all users
• Not persisting keys for revocation
• Embedding keys insecurely in clients