EVE New Citizens Q&A

from the page:

What is an API key? What do I use it for?
The API key is a private code that identifies your account and allows third party programs and web sites to access information about your characters and corporations. Using this data, such utilities can improve your EVE experience by providing useful functionality such as wallet exports, skill training notifications, and other tools.

Is this safe? Can someone steal my account?
It is safe to provide your API key to applications and web sites as long as you are prepared to allow the application or web site to see your character and corporation information. You can specify which information is accessible for each customizable API key.

Sharing an API key does NOT give people access to your account while sharing your account password would. Therein lies the whole purpose of API keys. An API key only allows the recipient to view your character and corporation data but gives them NO control over it. They are NOT able to log in to the game or post on the forums with the API information. No part of the API key information is in any way generated from your account password - there is no way to calculate your password using this information.

This is the only safe way to give programs and web sites access to your data. Do not give out your account username or password to any person, program, or web site. Please keep in mind that doing so is a violation of the EULA and can lead to account termination.

I still don't like it.
If you are not certain that the web site or program asking for your API key is safe, please do not give it to them! You are responsible for any usage of the information obtained by using your API keys.

I gave someone my API key and now I want them to stop using it!
If you believe that someone is misusing your API key, you can delete it from the list above or simply change the Verification Code. Please note that all programs and web sites that are using your old API key information will no longer be able to access your data unless you provide them with the updated info or a new API key.

You can view API activity on your account by using the API Access Log. If you believe someone is misusing one of your API keys, please change the Verification Code or delete the API key from the list above.


also a recent thread on the topic
https://forums.eveonline.com/default.aspx?g=posts&t=382078&find=unread

API is a window, not a door, they can look at a lot of stuff about your toon/account but can't change anything. Mostly it's used to guard against spies and AWOXers. You can decide how much you'd like to share with them, but corps will also have standards for how much they want to see.

As said.

A. It's a read only tool, so they can at no point alter anything (at this stage...)

B. If you don't want them to access it after you gave it to them, just delete it and access is instantly terminated.

C. It's common to weed out the bad spies / thiefs that try to infiltrate corps. Proper spies / thiefs won't get caught by an API check.

D. It's to check if your story matches the facts during recruitment mainly. (I in the past had a person who claimed he had NO experience with PvP and was a pure miner. He gave his API and voila, all I saw in his assets were PvP fitted ships. To be more precize, AWOX (corp killing) fitted ships).

E. What they give access too, that depends what you personally enable.

In the old days of "legacy" API keys you had 2 forms, partial and full API. So you gave out the pre-generated code for either of them.

Now we have CAK (Customize API Keys), which means you can have many different keys, each enabling just the things you like.
So I do advice, make a seperate key for each and every single one you give out, and give it a clear name what you used it for...so that if you want/need to delete one, it's easy to find.

OK i see they want it to weed out spies ... I guess that is the information i was looking for. Thanks for the kind replies and the additional information it will com in handy.