As an authentication token, an API key is pretty much functionally identical to a password.

Does it follow then that we should mask the API key, when it is entered in a settings dialog?

The reason NOT to mask it might be that it's not typically easy to remember through the 'shoulder-surfing' approach, so the utility of being able to easily compare the first few digits to some other key copied from a file somewhere might outweigh the security benefits of obscuring it.


Mask it, but:

  • allow it to be revealed via a click
  • include a copy to clipboard icon next to it

Although API keys are too long to be memorable via shoulder-surfing, they are vulnerable to high-resolution video recordings or photographs (e.g., surveillance cameras or film crews who dropped by for an interview).

There are several documented instances of credentials leaking out during live TV streams: TV5Monde, the SuperBowl and the 2014 World Cup are just a two of them.

enter image description here

Security is a context where adding a few additional hurdles could be a good thing, because you are dealing with sensitive information. The consequences of a leak can be anywhere in the spectrum between an annoyance and a disaster, so you have to consider that when making a UI decision.

As you noted yourself, users are not expected to manually type the API keys somewhere else, they will most likely use copy/paste to transfer them elsewhere. Thus, the copy to clipboard feature addresses that problem without compromising security.

There is little to gain from exposing API keys on the screen.


I guess it depends on who can access the stored API data and the implications of it being copied.

If it is in a user account behind a password then, is that enough to keep the information secure?

If the API is sensitive information but is not behind a passworded account, then maybe it should be? I would be reluctant to mask it as people accessing the information might need to refer to it again and might need to copy the data out, so having it masked would prevent that.

So, i know i have not answered the question one with a Yes/No, but hopefully i have offered some thoughts that will help you make a decision or engage further discussion.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.