[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[[["\u003cp\u003eAPI keys identify the calling project or application, not individual users, enabling project identification and authorization for API access.\u003c/p\u003e\n"],["\u003cp\u003eAuthentication tokens identify the user making a request, offering user authentication and authorization, which is a different functionality compared to API keys.\u003c/p\u003e\n"],["\u003cp\u003eAPI keys are less secure than authentication tokens because they are easily accessible to clients, and once stolen, they can be used indefinitely until revoked.\u003c/p\u003e\n"],["\u003cp\u003eAPI keys are useful for blocking anonymous traffic, controlling the number of API calls, identifying usage patterns, and filtering logs by project, but they are not meant for secure authorization.\u003c/p\u003e\n"],["\u003cp\u003eWhile API keys enable project identification and authorization for API access, they cannot be used to identify individual users, provide secure authorization, or identify the creators of a project.\u003c/p\u003e\n"]]],[],null,["# Why and when to use API keys\n\nOpenAPI \\| [gRPC](/endpoints/docs/grpc/when-why-api-key \"View this page for the Cloud Endpoints gRPC docs\")\n\n\u003cbr /\u003e\n\nThis page provides background information on API keys and authentication: how\neach of these are used, the differences between them, and the scenarios where\nyou should consider using API keys.\n\nAPI keys are for projects, authentication is for users\n------------------------------------------------------\n\nCloud Endpoints handles both API keys and authentication schemes, such as\nFirebase or Auth0. The main distinction between these two is:\n\n- API keys identify the calling project --- the application or site --- making\n the call to an API.\n\n- Authentication tokens identify a user --- the person --- that is using the app\n or site.\n\n\nAPI keys provide project authorization\n--------------------------------------\n\nTo decide which scheme is most appropriate, it's important to understand\nwhat API keys and authentication can provide.\n\nAPI keys provide\n\n- **Project identification** --- Identify the application or the project\n that's making a call to this API\n\n- **Project authorization** --- Check whether the calling application has been granted\n access to call the API and has enabled the API in their project\n\nAPI keys aren't as secure as authentication tokens (see\n[Security of API keys](#security_of_api_keys)),\nbut they identify the application or project that's calling an API. They are\ngenerated on the project making the call, and you can restrict their use to an\nenvironment such as an IP address range, or an Android or iOS app.\nBy identifying the calling project, you can use API keys to associate usage information with that project. API keys allow the [Extensible Service Proxy (ESP)](/endpoints/docs/openapi/glossary#extensible_service_proxy) to reject calls from projects that haven't been granted access or enabled in the API.\n\nAuthentication of users\n-----------------------\n\nBy contrast, authentication schemes typically serve two purposes:\n\n- **User authentication** --- Securely verify that the calling user is who\n they claim to be.\n\n- **User authorization** --- Check whether the user should have access to\n make this request.\n\nAuthentication schemes provide a secure way of identifying the calling user.\nEndpoints also checks the authentication token to verify that it\nhas permission to call an API. Based on that authentication, the API server\ndecides on authorizing a request.\n\nIf you need the ability to identify the user making the call, see\n[Authenticating users](/endpoints/docs/openapi/authenticating-users).\n\nWhile API keys identify the calling project, they don't identify the\ncalling user. For instance, if you have created an application that is calling\nan API, an API key can identify the application that is making the call, but not\nthe identity of the person who is using the application.\n\nIf you need a more secure way to limit which projects or services can call your\nAPI, see\n[Authentication between services](/endpoints/docs/openapi/service-account-authentication).\n\nSecurity of API keys\n--------------------\n\nAPI keys are generally not considered secure; they are typically accessible to\nclients, making it easy for someone to steal an API key. Once the key is stolen,\nit has no expiration, so it may be used indefinitely, unless\nthe project owner revokes or regenerates the key. While the restrictions you can\nset on an API key mitigate this, there are better approaches for\nauthorization.\n\nFor examples, see\n[Authenticating users](/endpoints/docs/openapi/authenticating-users).\n\nWhen to use API keys\n--------------------\n\nAn API may restrict some or all of its methods to require API keys. It makes\nsense to do this if:\n\n- You do want to block anonymous traffic. API keys identify an application's\n traffic for the API producer, in case the application developer needs to\n work with the API producer to debug an issue or show their application's\n usage.\n\n- You want to control the number of calls made to your API.\n\n- You want to identify usage patterns in your API's traffic. You can see\n application usage in\n [APIs \\& services](http://console.developers.google.com).\n\n- You want to filter logs by API key.\n\nAPI keys cannot be used for:\n\n- Identifying individual users --- API keys don't identify users, they\n identify projects.\n\n- Secure authorization.\n\n- Identifying the creators of a project.\n\n[Service Infrastructure](/service-infrastructure/docs/overview)\ndoesn't provide a method to directly look up projects from API keys.\n\nHow to use API keys\n-------------------\n\nTo learn how to set up and use API key access, see [Restricting access with API keys](/endpoints/docs/openapi/restricting-api-access-with-api-keys)."]]
