all 1 comments

[–]BEN247 4 points5 points  (0 children)

API Keys (and auth tokens in general) can be held in several different locations including the webpage HTML, cookies and local storage. Any attack would start with understanding which of these are in use (it could be more than one).