What an API key identifies
An API key is the string an application sends when it connects to an API, identifying whose contract or project the call belongs to. AI APIs from OpenAI, Google, and others use it to control which models you can reach, what permissions you have, how much you have used, and what you are billed.
It plays a role similar to a password, but for connections between programs rather than a person signing in. If a key leaks, someone else can run API calls on your account, and the charges land on you.
How it differs from an API and from OAuth
An API is the interface and the rules for using a service’s features or data from another application. The API key identifies the caller. People sometimes say they are “getting an API” when what they are issuing is the key that lets them use one.
OAuth lets a user grant scoped permission — read my calendar, nothing else — without handing their password to the app. API keys are usually tied to a project or an application; OAuth deals with a permission granted by a specific user.
Where to keep it
Keep keys out of source code. Store them in environment variables or a secrets manager. Never paste one into a repository, a blog post, a screenshot, or a prompt.
Embedding a key in browser JavaScript or in a distributed mobile app is a particular hazard, because anyone can inspect the package and extract it. Route those calls through a server you control and keep the key on the server side.
Using keys safely
- Use separate keys for development, testing, and production
- Restrict each key to the APIs it actually needs
- Set usage and spending limits, and turn on notifications
- Revoke keys you no longer use
- Delete and reissue immediately if you suspect a leak
When an AI agent needs to call an API, supplying the key at run time from something like 1Password is safer than pasting the string into a conversation. Do not assume an AI will keep a secret; apply the same standard you would to any person or application.