Why does MongoLab not recommend using their REST API?

Question

From the MongoLab's documentation, they recommend:

MongoLab databases can be accessed by your application code in two ways.

The first method - the one we strongly recommend - is to connect using one of the MongoDB drivers (as described above). You do not need to use our API if you use the driver.

The second method, which you should use only if you cannot connect via one of the MongoDB drivers, is via MongoLab’s RESTful data API.

Why do they recommend using the driver rather than their REST API? One reason I can think of is portability across different MongoDB providers. Are there any other reasons? Wouldn't it be more beneficial for MongoLab to "vendor lock-in" customers with their API?

Answer 1

The points that @WiredPrairie and @Stennie brought up around security are correct. *When you use our REST API, you expose your API key to the client. Currently, anyone with the API key can modify your database. As a result, we only recommend using the REST API with public data, e.g. all the locations for taco trucks in the country.

By writing your own app tier, you can keep credentials to your database from being exposed to the client.

If you have any more questions, email us at [email protected]. Happy to help!

-Chris@MongoLab

p.s. thanks @WiredPrairie and @Stennie