Unverified50% confidenceFactExact time
由于服务器不记录调用方身份的历史状态，单凭一串API Key字符串就足以代表完整的身份权限，Key一旦泄露即可被无限制滥用
1
Sources
50%
Confidence
Long-term
Relevance
7/21/2026
First Seen
Sources
Related Claims
UnverifiedOnce an API Key is leaked, an attacker can make unlimited API calls from anywhere in the world as the key holder, and the server cannot distinguish legitimate calls from unauthorized ones.81% similarUnverifiedOnce an API Key is leaked, others can charge expenses to your account; never hard-code it and commit it to a public code repository.74% similarUnverifiedWhen logging in with Passkeys, the server sends a random challenge, the device signs it with the private key and returns the result, and the server verifies the signature with the public key; since the private key is never transmitted, identity cannot be forged even if the server database is stolen.73% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/578230API
curl https://kongchang.com/api/v1/knowledge/claims/578230MCP
get_claim(id=578230)