Short answer
An API key is a unique code a program uses to identify itself when accessing another system’s API — a bit like a password for programs. It determines who is requesting the data and what they may do. An API key must be kept secret: it must not end up in public code, e-mails or the browser side.
How an API key is used
When your system requests data from, say, a payment service or an AI service, the API key is added to the request. The receiving system checks who the key belongs to and allows or denies access.
Security rules
- Don’t store keys in code — use environment variables or a secrets vault.
- Don’t put keys on the browser side (JavaScript on a website) — anyone can read them there.
- Least privilege — allow the key only the actions it needs.
- Separate keys for test and production environments.
- Rotate them regularly and revoke immediately if a key may have leaked.
API key or OAuth
An API key identifies a program. When access to a specific user’s data is needed (for example, their e-mail or calendar), OAuth is usually used — the user grants access themselves and can revoke it.
More about APIs: what is an API.