An API key is a unique string, often a long random token, that a client sends with each API request so the provider can identify the calling application or account. It is typically passed in a header or query parameter.
Why it matters
Providers use API keys to authorize access, measure usage, apply rate limits and bill customers. A key is a credential, so anyone who obtains it can act as you. Keys leaked in public repositories, front-end JavaScript or logs are a very common cause of abuse and unexpected bills. An API key identifies an application and is weaker than OAuth tokens, which represent a specific user and can be scoped and expired. Good practice is to keep keys on the server, restrict them by scope or IP where possible, and rotate them.
Example
curl https://api.example.com/v1/status \
-H "Authorization: Bearer sk_live_abc123"Keep the key out of source control by reading it from an environment variable instead of writing it into code.
Common mistakes
- Committing keys to Git, where they remain in history after deletion.
- Embedding a secret key in a mobile app or web page where users can extract it.
- Using one key everywhere so a leak cannot be contained or revoked selectively.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.