noun · API concept
API key
also called secret key
A password for the AI service. Whoever has it can use your account, and the bill lands on you.
A secret credential sent with API requests that identifies and authorizes the calling account.
A secret string that your server sends with each request so the provider knows which account to charge and which limits apply. Because it carries your account's authority, anyone who sees it can make requests as you.
Real-life example
You paste your key into a web page's code so it can call the service directly. A stranger opens the page, copies the key from the code, and runs up a large bill on your account. Keeping the key on your own server and calling from there would have kept it out of sight.
HTTP 401 UnauthorizedWhere the analogy breaks
-
It is not just an ID. It is a password for spending your money, so treat it like one and keep it out of shared code.
-
Never put it in front-end code or a public repository. Anything that reaches a browser or a public file can be copied by anyone.
-
Plan for leaks. Keep keys in environment settings or a secrets store, limit what each key can do, and rotate or revoke one quickly if it escapes.