Sharing the Web API Key

I was hoping to get some background about the security of the LimeLM web API key. Should this key be shared with others? Does having this key give anyone else the ability is issue activation licenses? Is this key protected in the PaymentSettings.php file or is it visible to anyone?

We are in a situation where one of our resellers will need to issue activation licenses to our application so we are trying to figure out the best way to manage this while still maintaining security of the license generation mechanisms.

Thanks

Should this key be shared with others?

No, consider it a password for your account. It should be treated with care. And if you ever feel it has been leaked then generate a new key immediately.

(Of course, we monitor API keys for odd behavior and block "brute forcing" and other methods.)

Does having this key give anyone else the ability is issue activation licenses?

Yes.

Is this key protected in the PaymentSettings.php file or is it visible to anyone?

So long as your server is secure (that is, no one has access to that file other than you and people authorized by you), then the key will be secure in the file.

We are in a situation where one of our resellers will need to issue activation licenses to our application so we are trying to figure out the best way to manage this while still maintaining security of the license generation mechanisms.

Create a new user for the reseller and just give them permission to create new keys. This way they're limited to creating keys and you can delete the user at any time.

Tell me if that helps.