What Is an API Key?
Table of Contents
What Is an API Key?
An API key is a unique code that identifies and authenticates an application when it requests data or services from another system's API. Think of it as a password that's issued to software rather than a person — when your app sends a request with a valid API key attached, the receiving service knows which account to bill, rate-limit or grant access to.
Why Exposing One Is Risky
If an API key leaks — for example, if it's accidentally committed to a public code repository, hardcoded into a mobile app that gets decompiled, or exposed in browser-visible JavaScript — anyone who finds it can use it to make requests under your account. Depending on what the key controls, this could mean unexpected charges on your bill, exposure of private data, or an attacker using your account's reputation to send spam or abuse a service until it's noticed and revoked.
Best Practices for Keeping Keys Secure
Store API keys in environment variables or a dedicated secrets manager, never directly in source code. Add key files to your project's ignore list so they're never accidentally committed to version control. Restrict each key's permissions to only what it actually needs, and set usage limits or IP restrictions where the provider supports them. Rotate keys periodically and immediately if you suspect a leak, and monitor usage logs for unusual spikes that might indicate unauthorised use.