Skip to content

Vimeo API Key

Service Name: Vimeo

Service Description: Vimeo is a video hosting, sharing, and services platform that provides high-quality video hosting and streaming capabilities for creators, businesses, and organizations.

Service Address: https://vimeo.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be applied at the account level for Enterprise plans

Secret Access Scope: Grants programmatic access to Vimeo's API for managing videos, users, albums, and other Vimeo resources based on the scope of permissions assigned to the API key.

Secret Revokement URL: https://developer.vimeo.com/apps

Secret Example: d23a1e0a98b0f4e7c6f8d9a0b1c2d3e4f5g6h7i8

Suspicious Activity Investigation Instructions:

  • Review the Vimeo Developer Dashboard for unusual API activity
  • Check for unexpected video uploads, modifications, or deletions
  • Monitor for unauthorized access to private videos or collections
  • Review API usage metrics for abnormal patterns or rate limit approaches
  • Check for changes in API app settings or scope permissions

Mitigation Instructions:

  • Log in to your Vimeo account and navigate to the Developer Portal at https://developer.vimeo.com/apps
  • Select the application associated with the compromised API key

  • Click on "Generate a new key" to invalidate the old key and create a new one

  • Update all legitimate applications and services with the new API key

  • Review and restrict the API permissions to only what is necessary
  • Consider implementing webhook notifications for sensitive API operations
  • For Enterprise customers, implement IP restrictions if available