What is API key?

What an API key is

An API key is a long, random string that works like a password for software. When your app, script or coding tool asks an AI provider such as OpenAI, Anthropic or Google to run a model, it attaches the key to the request. The provider reads the key, knows which account is asking, and bills that account.

Think of it as a hotel key card. The card does not say who you are. It simply opens the door, and it opens it for anyone who holds it.

How it works

You create a key in the provider's dashboard. The provider shows it once, and you copy it into the place that needs it: an environment variable, a config file, a secrets manager, or a field inside a third-party tool. From then on, every request carries the key, usually in a header.

The provider ties each key to a few things:

• An account and a bill. Usage under the key is charged to you.
• Limits. Many providers let you cap spending or restrict what a key can do.
• A history. Dashboards show usage per key, which is how you spot traffic you did not send.

Calls are metered in tokens, so a stolen key can burn through money quickly, especially on large models.

Why it matters

A leaked key is a stolen credit card with no signature check. The thief does not need your password or your data. They only need the string, and they can use it to run their own workloads, including training cheaper models on the outputs of expensive ones (see distillation).

Keys leak in ordinary ways: committed to a public code repository, pasted into a chat, left in a shared config file, or stored inside a third-party tool that later gets breached. The more places a key lives, the more places it can leak from.

Good habits

• One key per tool. If one tool is breached, you revoke one key and nothing else breaks.
• Spending limits. Set a monthly cap on every provider account.
• Never in code. Keep keys out of source files and out of anything you share.
• Rotate on suspicion. Revoke the old key and issue a new one from the provider's own dashboard, then update everything that used it.
• Scope it down. If the provider offers restricted keys, give each tool only the access it needs.
• Watch usage. Unexpected traffic or a climbing bill is the first sign of a leak.

How it relates to neighboring terms

Tools that call many providers on your behalf, such as an AI gateway, hold keys too, which makes them worth protecting. Autonomous software that uses keys, like an AI agent, should run inside an agent sandbox with only the keys it needs.