[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[[["\u003cp\u003eAPI keys identify the calling project or application, whereas authentication tokens identify the user making the request.\u003c/p\u003e\n"],["\u003cp\u003eAPI keys provide project identification and authorization, allowing you to track usage and control access to your API by specific projects.\u003c/p\u003e\n"],["\u003cp\u003eUnlike authentication tokens, API keys do not identify individual users and are not considered a secure method for user or service authorization.\u003c/p\u003e\n"],["\u003cp\u003eAPI keys are useful for blocking anonymous traffic, controlling API call volume, identifying usage patterns, and filtering logs, but they cannot identify individual users.\u003c/p\u003e\n"],["\u003cp\u003eAPI keys are not considered secure, however you can restrict their usage to mitigate some of the risk.\u003c/p\u003e\n"]]],[],null,["# Why and When to Use API Keys\n\n\u003cbr /\u003e\n\nThis page provides background information on API keys and authentication: how\neach of these are used, the differences between them, and the scenarios where\nyou should consider using API keys.\n\nAPI keys are for projects, authentication is for users\n------------------------------------------------------\n\nCloud Endpoints handles both API keys and authentication schemes, such as\nFirebase or Auth0. The main distinction between these two is:\n\n- API keys identify the calling project --- the application or site --- making\n the call to an API.\n\n- Authentication tokens identify a user --- the person --- that is using the app\n or site.\n\n\nAPI keys provide project authorization\n--------------------------------------\n\nTo decide which scheme is most appropriate, it's important to understand\nwhat API keys and authentication can provide.\n\nAPI keys provide\n\n- **Project identification** --- Identify the application or the project\n that's making a call to this API\n\n- **Project authorization** --- Check whether the calling application has been granted\n access to call the API and has enabled the API in their project\n\nAPI keys aren't as secure as authentication tokens (see\n[Security of API keys](#security_of_api_keys)),\nbut they identify the application or project that's calling an API. They are\ngenerated on the project making the call, and you can restrict their use to an\nenvironment such as an IP address range, or an Android or iOS app.\nBy identifying the calling project, you can use API keys to associate usage information with that project. API keys allow Cloud Endpoints Frameworks to reject calls from projects that haven't been granted access or enabled in the API.\n\nAuthentication of users\n-----------------------\n\nBy contrast, authentication schemes typically serve two purposes:\n\n- **User authentication** --- Securely verify that the calling user is who\n they claim to be.\n\n- **User authorization** --- Check whether the user should have access to\n make this request.\n\nAuthentication schemes provide a secure way of identifying the calling user.\nEndpoints also checks the authentication token to verify that it\nhas permission to call an API. Based on that authentication, the API server\ndecides on authorizing a request.\n\nIf you need the ability to identify the user making the call, see\n[Authenticating users](/endpoints/docs/frameworks/python/authenticating-users).\n\nWhile API keys identify the calling project, they don't identify the\ncalling user. For instance, if you have created an application that is calling\nan API, an API key can identify the application that is making the call, but not\nthe identity of the person who is using the application.\n\nIf you need a more secure way to limit which projects or services can call your\nAPI, see\n[Authentication between services](/endpoints/docs/frameworks/python/service-account-authentication).\n\nSecurity of API keys\n--------------------\n\nAPI keys are generally not considered secure; they are typically accessible to\nclients, making it easy for someone to steal an API key. Once the key is stolen,\nit has no expiration, so it may be used indefinitely, unless\nthe project owner revokes or regenerates the key. While the restrictions you can\nset on an API key mitigate this, there are better approaches for\nauthorization.\n\nFor examples, see\n[Authenticating users](/endpoints/docs/frameworks/python/authenticating-users).\n\nWhen to use API keys\n--------------------\n\nAn API may restrict some or all of its methods to require API keys. It makes\nsense to do this if:\n\n- You do want to block anonymous traffic. API keys identify an application's\n traffic for the API producer, in case the application developer needs to\n work with the API producer to debug an issue or show their application's\n usage.\n\n- You want to control the number of calls made to your API.\n\n- You want to identify usage patterns in your API's traffic. You can see\n application usage in\n [APIs \\& services](http://console.developers.google.com).\n\n- You want to filter logs by API key.\n\nAPI keys cannot be used for:\n\n- Identifying individual users --- API keys don't identify users, they\n identify projects.\n\n- Secure authorization.\n\n- Identifying the creators of a project.\n\n[Service Infrastructure](/service-infrastructure/docs/overview)\ndoesn't provide a method to directly look up projects from API keys.\n\nHow to use API keys\n-------------------\n\nTo learn how to set up and use API key access, see [Restricting access with API keys](/endpoints/docs/frameworks/python/restricting-api-access-with-api-keys-frameworks)."]]
