What Is an API Key?
How API Keys Identify a Caller
What is an API key? An API key is a unique string that an API provider issues to a project, application or account. The caller includes the key in each request so the API knows which account is calling, which usage limits apply and what the key is allowed to do.
Think of a key as a long password that belongs to an application rather than to a person. The key itself is the credential, so anyone who holds it can generally use the API as that application. This makes protecting the key the central concern when using one.
Sending Keys, Scopes and Permissions
Keys are usually sent in a request header, often named Authorization or a provider-specific header. Some providers also accept a query parameter, but a key placed in a URL can end up in server logs, browser history and shared links, so headers are the safer choice.
Many providers attach scopes or permissions to a key, so a key that reads invoices cannot also issue refunds. Scopes limit the damage if a key leaks. Providers may also tie each key to a usage quota, so an abused key can be throttled or revoked without affecting other customers. Limits of this kind are explained in API rate limiting.
Keeping Keys Secret and Rotating Them
An API key placed in front-end JavaScript is visible to anyone who opens the browser's developer tools, and a key committed to a public code repository can be picked up by automated scanners quickly. Keys belong on the server, where they can be kept in environment variables or a secrets manager.
Rotation means replacing a key on a regular schedule, or immediately after a suspected leak. A common approach is to issue a new key, move the application to it and then revoke the old one. Many providers let two keys stay active during the switch, so the service does not stop.
A Hosting Reseller Example
A hosting reseller uses an API key so its billing system can create customer accounts on a provider's platform. A developer accidentally commits the key to a public repository. The reseller revokes that key, issues a new one, updates the server configuration and reviews the platform's logs for calls made with the old key. Because the key was limited to account creation, it could not be used to change billing details or delete servers.
Frequently asked questions
Is an API key the same as a password?
They are similar, since both are secrets that grant access, but they are usually issued differently. A password identifies a person and is typed by hand, while an API key identifies an application and is sent automatically with every request. Keys are typically long and random and can be revoked one at a time.
Can an API key be used safely in a mobile or browser app?
Not if it is a secret key. Anything bundled into a browser or mobile app can be extracted, so the key should be treated as public. Those apps usually call their own server, which holds the secret key, or use a user-based method such as OAuth instead.