How to Pass API Key Credentials in the query parameters

[sk0809]

We've generated API Key credentials and want to include the api key dynamically in the query parameters when calling an endpoint via Rest Message. While I know this can be done with a script, are there alternative methods to pass the key without decrypting it? Decrypting would expose it as plain text in the logs, which we want to avoid.

[lastreaction122]

---

@sk0809 wrote:

We've generated API Key credentials and want to include the api key dynamically in the query parameters when calling an endpoint via Rest Message. While I know this can be done with a sound script, are there alternative methods to pass the key without decrypting it? Decrypting would expose it as plain text in the logs, which we want to avoid.

---

Consider using secure storage methods like environment variables or encrypted data stores available in your system or platform. These allow you to securely reference the API key directly within the request, eliminating the need for decryption and preventing exposure in logs. Alternatively, you can include the API key in an HTTP header rather than as a query parameter, which is generally safer and prevents accidental logging in URLs. For example, you could set the API key as an Authorization header (Authorization: Bearer {API_KEY}) or as a custom header (x-api-key: {API_KEY}), depending on the API’s requirements. 

[Mrcarlos725]

Yes i also agree with this first of all we may generate API Key with all essential keys and proper procedure as described. As well as, want to create well secure and trustworthy storage to proceed further in the matter.

[Mrcarlos725]

Yes, 

We've generated API Key credentials and want to include the api key dynamically in the query parameters when calling an endpoint via Rest Message. While I know this can be done with a well balanced sound script, are there alternative methods to pass the key without decrypting it? Decrypting would expose it as plain text in the logs, which we want to avoid.

First of all we must consider all the above parameters then go ahead.

[-O-]

The only way to do this so that it does not expose the key is if you encrypt the key using a public key provided by the endpoint party. The endpoint party would possess the private key end only it would be able to decrypt the key in the header. Of course that means that the endpoint party would need to implement such public key support and it would need to generate the public-private key pair.