API Keys as Shared Secrets

Keys identify a caller — practice only on 127.0.0.1:8812.

API Keys as Shared Secrets• Audio Walkthrough

00:00/03:55

Visual · authn_api_keys

API keys ≠ passwords for humans, still secrets. 127.0.0.1:8812.

An API key is a shared secret with a boring job: prove which client is calling — not which human typed a password today.

Many APIs accept a static key in a header (X-API-Key) or query (bad habit). The key is a credential. It belongs in a secret store, not a public repo, not a screenshot, not a Discord paste. Rotation and least privilege matter as much as length. Original Cyberlium Module 3. Use lab keys on 127.0.0.1:8812 only. You will NOT scrape stranger keys from GitHub, not hydra key fields, not phish “paste your key” pages. Next: Bearer Tokens and Sessions.

1. Where the key may live — and where it may not

Prefer Authorization or a dedicated header over query strings (query strings leak via logs and Referer). Prefer environment variables or a local 600 file over hardcoding in source you might push.

On YOUR lab, practice sending X-API-Key: lab-demo-key and watching 401 without it. That is enough to feel the control.

Command guide

Try these commands — Where the key may live — and where it may not

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

API keys — https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html RFC 6750 Bearer — https://datatracker.ietf.org/doc/html/rfc6750

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install curl
sudo apt install openssl

macOS: Built-in

Windows: Built-in (PowerShell: Invoke-WebRequest)

Command — copy this

choco install openssl

═══ LINUX / macOS ═══

Command — copy this

openssl rand -hex 16 | tr -d '
'; echo '  # example lab API key material'
curl -sS -H "X-API-Key: lab-demo-key" http://127.0.0.1:8812/v1/ping
curl -sS -o /dev/null -w "wrong key %{http_code}
" -H "X-API-Key: invalid" http://127.0.0.1:8812/v1/ping

Primary tools to practice this lesson: curl, openssl. Reference sites: API keys (https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html); RFC 6750 Bearer (https://datatracker.ietf.org/doc/html/rfc6750). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Static keys are long-lived blast radii

If a key escapes, every caller using it is the attacker until you rotate. Name a rotation rule in notes even for toys: “compromise → new key → restart lab.”

Never reuse a real cloud key in Cyberlium notes. Generate a fake lab string.

3. Ethics: other people’s keys are not a curriculum

GitHub dorking for AWS keys is not Module 3 homework. Reporting a leak you accidentally find on YOUR repo is defense. Hunting strangers’ secrets is not.

Phishing pages that say “validate your API key” are out. Delete them if they appear in a “toolkit” zip.

4. What you ship: lab key hygiene rules and one 401/200 pair

Header-not-query preference. Fake lab key only. 401 without key, 200 with key on 127.0.0.1:8812. DEMO GATE. No stranger key hunting.

5. What you record before the next lesson

Date. Header used. 401/200 observed. NEVER real cloud keys in notes. File t13-m03-l01-api-keys.txt chmod 600.

6. Wrong vs right: stranger APIs vs literacy on systems you own

Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.

Wrong: Commit a real AWS key. Put keys in ?api_key= on a public gist. hydra X-API-Key on a SaaS.
Right: Lab key on loopback. Next: Bearer Tokens and Sessions.

Hands-on Exercise