API key management in Microservices - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the primary purpose of API key management in microservices?

API key management controls and secures access to microservices by issuing, validating, and revoking unique keys for clients.

intermediate

Name two common methods to store API keys securely.

API keys can be stored securely using encrypted databases or dedicated secrets management services like HashiCorp Vault or AWS Secrets Manager.

intermediate

Why is it important to rotate API keys regularly?

Regular rotation limits the risk of compromised keys being used maliciously and helps maintain security hygiene.

beginner

What role does rate limiting play in API key management?

Rate limiting restricts how often a client can use an API key, preventing abuse and protecting system resources.

advanced

Explain the difference between API key authentication and OAuth.

API key authentication uses a simple key to identify clients, while OAuth provides delegated access with tokens and scopes for finer control.

What is the first step in API key management?

A Encrypting the API key

B Logging API key usage

C Revoking the API key

D Issuing a unique API key to a client

The first step is to issue a unique API key to identify and authenticate the client.

Which of the following is NOT a best practice for API key management?

A Using HTTPS to transmit keys

B Storing keys in plaintext files

C Rotating keys regularly

D Limiting key permissions

Storing keys in plaintext files is insecure and should be avoided.

How does rate limiting help in API key management?

A It encrypts the API key

B It stores API keys securely

C It restricts the number of requests per key

D It generates new API keys automatically

Rate limiting restricts how many requests a client can make using their API key to prevent abuse.

What is a common way to revoke an API key?

A Delete the key from the database

B Encrypt the key

C Send a notification email

D Increase the key's permissions

Revoking usually involves deleting or disabling the key in the system to prevent further use.

Which system is designed specifically for managing secrets like API keys?

A HashiCorp Vault

B MySQL

C Redis

D Nginx

HashiCorp Vault is a dedicated secrets management tool for securely storing API keys and other sensitive data.

Describe the key components and workflow of API key management in a microservices environment.

Think about how a client gets a key, how the system checks it, and how keys are kept safe or disabled.

Explain why API key management is critical for security and scalability in microservices.

Consider what could happen without proper key management and how it helps keep the system safe and efficient.

Practice

1. What is the primary purpose of API key management in microservices?

easy

A. To generate random data for APIs

B. To speed up API response times

C. To store user passwords securely

D. To control and monitor access to APIs

Solution

1. Step 1: Understand API key management role

   API key management is about controlling who can use APIs and tracking their usage.

2. Step 2: Identify the main goal

   The main goal is to secure APIs by controlling and monitoring access, not speeding up or storing passwords.

3. Final Answer:

   To control and monitor access to APIs -> Option D

4. Quick Check:

   API key management = Access control [OK]

Hint: API keys control who uses your API [OK]

Common Mistakes:

• Confusing API keys with password storage
• Thinking API keys improve speed
• Assuming API keys generate data

2. Which of the following is the correct way to represent an API key in a request header?

easy

A. Auth-Key: <API_KEY>

B. Authorization: Bearer <API_KEY>

C. API-Key: <API_KEY>

D. Key: <API_KEY>

Solution

1. Step 1: Review common API key header formats

   API keys are often sent in headers named API-Key or similar, but Authorization: Bearer is usually for tokens, not API keys.

2. Step 2: Identify the standard header for API keys

   API-Key is the widely accepted header for API keys, making API-Key: <API_KEY> correct.

3. Final Answer:

   API-Key: <API_KEY> -> Option C

4. Quick Check:

   API key header = API-Key [OK]

Hint: API keys use 'API-Key' header, not 'Authorization: Bearer' [OK]

Common Mistakes:

• Using 'Authorization: Bearer' for API keys
• Confusing header names
• Omitting the key value

3. Given this pseudocode for API key validation:

function validateKey(request) {
  key = request.headers['API-Key']
  if key is null or key not in validKeys:
    return 'Access Denied'
  else:
    return 'Access Granted'
}

What will be the output if the request has no 'API-Key' header?

medium

A. Access Denied

B. Error: Missing header

C. Access Granted

D. Access Pending

Solution

1. Step 1: Check header presence condition

   The code checks if the key is null or not in validKeys. If the header is missing, key is null.

2. Step 2: Determine the return value for missing key

   Since key is null, the condition is true, so the function returns 'Access Denied'.

3. Final Answer:

   Access Denied -> Option A

4. Quick Check:

   Missing key = Access Denied [OK]

Hint: No API-Key header means deny access [OK]

Common Mistakes:

• Assuming missing key grants access
• Expecting an error instead of denial
• Confusing 'null' with empty string

4. A developer wrote this code snippet to revoke an API key:

function revokeKey(key) {
  if key in activeKeys:
    activeKeys.remove(key)
  else:
    print('Key not found')
}

But the key is still accepted after revocation. What is the likely issue?

medium

A. The remove method does not delete keys properly

B. The key is not removed from the validKeys list used for validation

C. The function does not print 'Key revoked' message

D. The key is being re-added automatically elsewhere

Solution

1. Step 1: Understand key revocation logic

   The function removes the key from activeKeys, but validation likely checks validKeys.

2. Step 2: Identify mismatch in key storage

   If validation uses validKeys and revoke removes from activeKeys, the key remains valid.

3. Final Answer:

   The key is not removed from the validKeys list used for validation -> Option B

4. Quick Check:

   Revocation must remove key from validation list [OK]

Hint: Revoking must remove key from validation store [OK]

Common Mistakes:

• Removing key from wrong list
• Assuming print messages affect logic
• Ignoring other code re-adding keys

5. You need to design an API key management system for a microservices platform that supports millions of users. Which approach best balances security, scalability, and ease of revocation?

hard

A. Store API keys in a centralized database with caching and use short-lived keys with rotation

B. Embed API keys directly in client apps without server validation

C. Use a single global API key for all users to simplify management

D. Store API keys only in memory on each microservice without persistence

Solution

1. Step 1: Evaluate security and scalability needs

   Millions of users require scalable storage and fast validation. Centralized DB with caching supports this.

2. Step 2: Consider revocation and key rotation

   Short-lived keys with rotation improve security and allow easy revocation without downtime.

3. Step 3: Eliminate insecure or unscalable options

   Embedding keys in clients or using a single key is insecure; in-memory only storage lacks persistence and scalability.

4. Final Answer:

   Store API keys in a centralized database with caching and use short-lived keys with rotation -> Option A

5. Quick Check:

   Central DB + caching + rotation = secure & scalable [OK]

Hint: Use central DB with caching and rotate keys regularly [OK]

Common Mistakes:

• Using single global key for all users
• Not persisting keys for revocation
• Embedding keys insecurely in clients