Skip to main content

💼 1.13 Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps - Level 2 (Manual)

  • Contextual name: 💼 1.13 Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps - Level 2 (Manual)
  • ID: /frameworks/cis-gcp-v3.0.0/01/13
  • Located in: 💼 1 Identity and Access Management

Description​

API Keys should only be used for services in cases where other authentication methods are unavailable. In this case, unrestricted keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API key usage to trusted hosts, HTTP referrers and apps. It is recommended to use the more secure standard authentication flow instead.

Similar​

  • Internal
    • ID: dec-c-231f1cb0

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags

Policies (1)​

PolicyLogic CountFlags
📝 Google API Key is not restricted for unspecified hosts and apps 🟢🟢 x3