5

I am currently working on a project which uses Blogger API from Google. Day before yesterday (saturday) someone attacked my application and grab the API Key, My daily limit for accessing posts is 100,000 (100K/24 hrs). I hit limit on Saturday (I suspect that those were fraudulent clicks made using my API key, since I've only around 4K customers using the application, I embedded the API key in client side code).

After that, In five minutes API limit reached again (after 24 hrs) 5K. So I deleted the API key and generated a new one.

My question is how can I secure my new API Key in client code, so that no attacker can gain access to API key or at least some method to indirectly use the API Key in Client Code.

flx
  • 14,146
  • 11
  • 55
  • 70
Nitin Misra
  • 4,472
  • 3
  • 34
  • 52

1 Answers1

2

The Google API console lets you bind your API key to a set of signing certificates of the app.
If you limit the API key to a few certificates, the API should be useless to an attacker. (As long as you keep your private key secret.)

flx
  • 14,146
  • 11
  • 55
  • 70
  • I am not using api key for android app (which provide a functionality to accept request from apps with particular SHA Hash) instead i'm using "Key for browser apps (with referers)" which doesn't provide this functionality. Take a look at this http://postimg.org/image/efbhm3oup/full/ – Nitin Misra Sep 09 '13 at 08:04
  • I does what you said but now i'm getting this error response from server `{ "error": { "errors": [ { "domain": "usageLimits", "reason": "accessNotConfigured", "message": "Access Not Configured" } ], "code": 403, "message": "Access Not Configured" } }` – Nitin Misra Sep 09 '13 at 08:49