title: How to Secure REST API with API Keys
body: <p>My architecture consists of a front end server and a backend/API server. The API is accessible to the end user, however I want the front end server to be able to access certain routes of the API that aren't accessible to the end user (higher privilege). </p>
  
  <p>This question has 2 parts:</p>
  
  <p>(1) I need to use API keys for the end user. What's the best practice to do this? </p>
  
  <p>(2) How does the front end play into the API Key system? The client will need to log into their account to access these elevated privileges available from the front end. (such as enabling webhooks)</p>
  
  <p>My application is hosted on Google Cloud App Engine Standard env and I'm using node.js 10. It would be awesome if anyone had any suggestions relating to this architecture. </p>
  
  <p>I know this question is somewhat general but I've spent a few hours looking around online and my question isn't so much how to use API keys, nor how to authenticate frontend, but rather: what is the best practice to do these two together?</p>
  
  <p>Thanks,
  Nikita</p>