200-901 Question 50
Single answerA developer is creating an application that integrates with a third-party API. The API requires authentication via an API key that must be included in all HTTP requests. Where is the most appropriate location to include the API key in the request?
- A
In the HTTP request body
- B
In the HTTP request URL as a query parameter
- C
In the HTTP request header
- D
In the HTTP request's cookies
Show answer and explanation
Correct answer: C
Explanation
The API key should be included in the HTTP request header, as this is the standard and secure method for transmitting authentication data. Using headers ensures that sensitive information like API keys is not exposed in URLs or logs, reducing the risk of unauthorized access.
- A. Incorrect.
Including the API key in the HTTP request body is not a common or secure practice for API authentication. The body is typically used for data payloads and not for authentication.
- B. Incorrect.
While including the API key as a query parameter is technically supported by some APIs, it is not considered secure because query parameters can be logged in server logs or intercepted in URLs.
- C. Correct.
Using the HTTP request header is the most common and secure way to include an API key. Headers are designed to carry metadata, including authentication information, making this approach both standard and secure.
- D. Incorrect.
Cookies are primarily used for session management in web applications and are not a typical method for transmitting API keys for authentication.