What is an API key?

API key meaning

An API (application programming interface) is a way for one program to ask another for data or to do a job. A weather app asks a weather API for a forecast. A chatbot app sends your message to an AI model's API and gets a reply back. Our APIs course explains how these requests work from the start.

Most APIs don't answer just anyone. Answering costs the provider money, so it needs to know who is asking. The key is how a program proves that. When a developer signs up, the provider creates a key linked to their account or project. Their program then sends that key with every request.

API key example

An API key is just a long string of random characters. Many providers add a short prefix so a key is easy to recognise. Here is a made up one:

wx_live_7Qm2tVx9Lk4pR8sWz3Hn6Bc1Ya5Ue0Jd

The randomness is the point. A key this long can't be guessed, so the only way to get it is to be given it, or to find one someone has leaked.

How does an API key work?

1. You create the key in the provider's dashboard and copy it once.
2. You store it somewhere private, usually an environment variable on your server.
3. Your program sends it with each request, almost always in an HTTP header.
4. The provider checks it: does the key exist, is it still active, is it allowed to use this part of the API, and is it under its limits?
5. The provider answers or refuses, and records the request against your account.

Here is what step 3 looks like, as a request to a made up weather API. The key travels in the Authorization header, read from an environment variable so it never appears in the code itself.

curl "https://api.example.com/v1/forecast?city=Leeds" \
  -H "Authorization: Bearer $WEATHER_API_KEY"

Real services each choose their own header. These were the documented ones on 7 November 2026:

When the key is wrong

If the check fails, the API replies with an error status code instead of data. These three are the ones you will meet most:

The names come from the HTTP standards (RFC 9110 for 401 and 403, RFC 6585 for 429). A 401 almost always means a problem with the key itself, so check it was copied fully, with no spaces at either end.

What are API keys used for?

• Identifying the caller. The provider knows which project each request belongs to.
• Billing. Paid APIs charge per request or per amount of data, and the key says whose bill it goes on. An AI API, for example, bills by the token, as our guide on tokens in AI explains.
• Limits. Each key can have a cap on requests per minute or per day, so one app can't overload the service.
• Access control. A key can be limited to certain parts of an API, certain websites or certain IP addresses.
• Switching access off. Deleting a key stops every program using it at once, without touching anyone else.

What a basic API key doesn't do is identify a person. Google Cloud's documentation puts it plainly: a standard API key associates a request with a project for billing and quota purposes, and "doesn't authenticate a principal", meaning a particular user or account.

API key vs token

API keys and access tokens both travel with requests, and both are secret strings, so they are easy to confuse. The difference is who they stand for and how long they last.

A password is different again: it belongs to a person and is typed into a login form, while an API key lives inside software. "Sign in with Google" buttons use tokens, not API keys, so the app never sees your Google password.

How to get an API key

The steps are much the same for every provider:

1. Make a developer account with the provider. This is often separate from the ordinary consumer account, and paid APIs may ask for a payment method.
2. Find the page called API keys, credentials or developer settings.
3. Create a new key and give it a name that says where it will be used, like "weather-app-production".
4. Copy the key straight into a safe place. Many dashboards show it in full only once.
5. Add any restrictions and spending limits the dashboard offers before you use it.

For the AI APIs people search for most: a Gemini API key comes from the API Keys page in Google AI Studio, an OpenAI API key from your OpenAI platform account, and a Claude API key from the API keys page of the Claude Console. These are developer keys. A ChatGPT, Gemini or Claude chat subscription doesn't come with one.

How to keep an API key safe

A leaked key lets a stranger run up your bill or use up your limits. These rules come straight from the providers' own documentation.

• Keep it on the server. Never put a secret key in website JavaScript or in a mobile app. OpenAI says not to "expose it in any client-side code such as browsers or apps", and Google warns that users can extract keys from client-side code. Send requests through your own server instead.
• Use an environment variable. Keep the key out of your code entirely and read it when the program starts.
• Never commit it to Git. Google says to never check API keys into source control. Put your .env file in .gitignore.
• Add restrictions. Limit the key to the APIs, websites or IP addresses that need it. Google calls unrestricted keys insecure.
• Use one key per app and per environment. Then you can delete one without breaking everything else, and you can see which app made which requests.
• Set spending limits and delete old keys. A key you no longer use is a risk with no benefit.

Here is the safe pattern in Node.js. The key lives in a .env file that Git ignores, and the server reads it from the environment. Node can load the file itself with its --env-file option.

// .env (listed in .gitignore, never committed)
// WEATHER_API_KEY=wx_live_7Qm2tVx9Lk4pR8sWz3Hn6Bc1Ya5Ue0Jd

// server.js, started with: node --env-file=.env server.js
const key = process.env.WEATHER_API_KEY;

const res = await fetch('https://api.example.com/v1/forecast?city=Leeds', {
  headers: { Authorization: `Bearer ${key}` },
});
const forecast = await res.json();

Try it: this question shows you some code and asks you to spot the one that puts an API key at risk.

What to do if your API key is leaked

1. Revoke or delete the key straight away in the provider's dashboard. This is the only step that actually stops misuse.
2. Create a new key and put it in your environment variables.
3. Check your usage and billing for requests you didn't make, and contact the provider if you find any.
4. Find out how it leaked and fix that, so the new key doesn't go the same way.

Deleting the commit isn't enough. Once a key has been pushed to a public repository, assume someone has copied it. GitHub's secret scanning checks public repositories for credentials such as API keys for free, and for many providers it tells the provider, who may revoke the key for you.

Common mistakes

• Putting the key in front end code. Anything sent to a browser can be read with the developer tools, however well it is hidden.
• Committing a .env file. Add it to .gitignore before your first commit, not after.
• Sharing one key across every project. One leak then breaks everything, and you can't tell which app is using what.
• Pasting a key into a chat, forum post or screenshot when asking for help. Replace it with a placeholder first.
• Thinking an API key logs in a user. It identifies a project. For users, use proper login and tokens.
• Leaving keys unrestricted. Restrictions limit the damage if a key does leak.

Read next

Computer Science · Web and APIsWhat does API stand for? APIs explained with examplesWhat API stands for, how an API works, what an API call is, with a real request and response, plus API types, API access and API testing.