Every download link contains an API key

[VoidEmperor 13]

Every download link generated by Emby includes an API key.

Example: https://host.com/emby/Items/14354/Download?api_key=2855fe84eexxxxxxxxxxxxxxxxxxxde542df

Is it safe to share this link with anyone? Can this key be misused in anyway?

[Luke 42077]

Hi, I would not share it. We plan to rework this is an upcoming update so the apikey in the url will have limited privileges and then you would be able to share it.

[VoidEmperor 13]

Thanks, I appreciate the effort.

[playingbball20 0]

I'll see if I can re-up this post. I want able to edit a post which has my API key in it. However. I deleted all of my API keys and I'm still able to open Emby with the API key. Is there anyway to delete that key? I am using docker, but I couldn't find anywhere that API key is stored at.

[Luke 42077]

23 minutes ago, playingbball20 said:

I'll see if I can re-up this post. I want able to edit a post which has my API key in it. However. I deleted all of my API keys and I'm still able to open Emby with the API key. Is there anyway to delete that key? I am using docker, but I couldn't find anywhere that API key is stored at.

When you do a log out, the api key in that url will be invalidated.

[playingbball20 0]

I logged off last night but I didn't realize I was logged into 2 places with my username.

[Luke 42077]

When I say log out I mean explicitly clicking log out in the menu.

[VoidEmperor 13]

On 7/9/2025 at 1:47 AM, Luke said:

When you do a log out, the api key in that url will be invalidated.

Hi @Luke

If non-admin users download and get an API key, can that key be used to do any admin-level activities? I am not sure which user logout you mean.

[Luke 42077]

5 hours ago, VoidEmperor said:

Hi @Luke

If non-admin users download and get an API key, can that key be used to do any admin-level activities?

No, that's not possible.