What are Subaccounts?
Subaccounts are a design pattern to divide an organization's API access based on business units (ie. departments, teams), allowing for larger organizations to have finer-grain control and tracking over their API integrations.
A Subaccount API Key (also known as Subkey) is a "virtual" API key that created alongside the Subaccount, and grants that Subaccount (potentially limited) access to the API. Calls from Subaccount keys will all be summed and counted against the organization's overall quotas and rate limits. This means API usage must still be governed and monitored at the organization-level.
An analogous concept in the world of finance is virtual credit cards which are used to better track purchases/spend at a department level, but can also be safely deleted when compromised without the original credit card being compromised or having to be replaced.
Benefits of Subaccounts
- Tailored Reporting: Analytics and reports are presented at the Subaccount key level, meaning your dashboards/reports are automatically scoped to your department.
- Fine-grain Permissions: Managers of the API can typically assign stricter controls to the Subaccounts (ex. lower quotas or rate limits) based on the expected usage of that subdivision/department. Some APIs even provide the ability to restrict access to certain APIs for Subaccounts.
- Security: In addition to being able to limit API access at the Subkey level - a Subkey is ideally only used within a single department's code. This significantly reduces the amount of work needed to successfully roll the Subkey - as the surface area of the change(s) will be limited to that department.
- Account Sharing: Sharing access to an API with the appropriate permissions and access controls is easier with Subaccounts. If you're already part of a Subaccount, you can simply invite a coworker and they will automatically have the correct access.
- Budget Tracking: Accessing 3rd party APIs can be expensive, and many large organizations need to be able to break down costs at a department level for accounting purposes. Subaccounts (especially 1st party offerings) allow for billing reports at the department level - and may even let departments pay their own bills independently.
Which Companies Offer Subaccounts?
- Email and communication APIs like Twilio, Vonage, Mailjet, and Mailgun, which makes sense given almost all departments need to send emails or text messages.
- Stock Trading and Crypto Exchange APIs like Binance and BitMEX use Subaccounts to scope trading abilities and access to certain financial instruments/derivatives.
Should I Offer Subaccounts?
If your API is commonly used across organizations (ex. it performs a common and essential business function like email, image management, analytics) then consider building a 1st party implementation of Subaccounts within your product. I actually already created a guide to building Subaccount Keys that should have you up-and-running in 30 minutes.
What If an API Doesn't Offer Subaccounts?
If an API you are integrating with does not offer Subaccounts - you can actually build a lightweight api integration platform and issue/manage Subkeys within your organization.
