API key

in English: API key

basicwidespread

An API key is a long, secret string of characters with which a program authenticates itself to an online service so that the service can process requests and bill usage.

In plain terms

Imagine the magnetic card at a hotel: your name is not on it, yet it opens the door, and the hotel knows exactly which room it belongs to. An API key is just such an access card, but designed for programs, not people. It is a long, random string of letters and numbers that the program attaches to every request.

It is useful for two software programs to work together without human intervention. If an application or an AI agent requests weather data, loads a map, or waits for an answer from a language model, the key shows the provider who the request is on behalf of and whose account should be billed.

It differs from a password in that you do not type it in; the program uses it on your behalf, and it usually belongs to an application or project rather than a person. However, it is the same in that whoever obtains it can use the service in your name and at your expense.

How it works

You register with a provider and create a key in your account; in many places you see the full key only once, so you must immediately save it in a secure location.
Put the key in your program's or agent's settings, preferably not in the code itself but in a separate, protected location.
The program attaches the key to every request via an encrypted connection.
The provider checks whether the key is valid, what it authorizes, and whether you have exceeded your limit; if everything is in order, it responds and logs the usage.
If the key is leaked or is no longer needed, you revoke it in your account and request a new one; the old one usually becomes unusable immediately, but within a few minutes at most. Revocation does not undo previous misuse, so it is worth reviewing the usage log and the bill.

An everyday example

You try a new note-taking app that promises AI summaries, but first it asks: 'provide your own API key'. In this case, you create a key with the language model provider, paste it in, and from then on the app requests summaries from your budget, billed to your account.

Who is affected

developerThey work with keys day in and day out, and it is their responsibility to ensure these do not end up in public code, logs, or screenshots. → Code

entrepreneur, executiveA leaked corporate key can cause a serious bill and a data breach incident within hours, so it must be regulated who handles it and how.

employeeIf you connect an AI tool or agent to company systems, you will most likely be handed a key, and it must not be forwarded by email or chat. → Work & HR

everyoneMore and more applications ask you to provide your own key, and it is worth knowing that this grants access to your wallet.

A common misconception

MythAn API key is only a technical identifier and can be freely shared or uploaded with the code.

In realityThe key is a secret, like your bank card details: whoever obtains it can use the service in your name and at your expense. Automated programs comb public code repositories for leaked keys, so abuse can begin within minutes. The only exception is keys explicitly meant to be public, so-called publishable keys (for example, a mapping service key embedded in a web page), but these too must be restricted, for example to a specific website and a specific function.

Limits and risks

The key alone does not prove who is using it: it lets in anyone who holds it, so a stolen key works as a full pass.
Many keys grant excessive permissions by default and never expire; if possible, restrict their permissions, set a budget limit, and rotate them regularly.
If you give an agent a key, it can do everything the key authorizes, even if it misunderstands the task or receives malicious instructions.
A key embedded in a website or mobile app can be read by a knowledgeable person, so the truly secret key must reside on the server.

Similar, but not the same

Password – A human types the password into their own account, while an API key is used by a program and typically belongs to an application or project.
Access token – A token is usually short-lived, granted for limited rights, and often created with the consent of a specific user, whereas an API key is typically long-lived and valid until revoked.
Encryption key – Encryption keys make data unreadable and readable again, while API keys do not encrypt anything but serve as access credentials.

Related concepts

Broader

Authentication, Access Management, Cybersecurity

Narrower

Titkos API-kulcs, Publishable key, Limited-access key

On the edge

API, Access token, OAuth, confidentiality, Rate limiting

A brief history

API keys became widespread in the first half of the 2000s with the emergence of public web APIs, when major internet companies opened their services to external developers. With the rise of generative AI, they spread from a narrow circle of developers to everyday users.

Where things stand

At the end of 2026, the API key is the simplest and most common method for program-to-program access, and the vast majority of AI services are available this way. With the spread of agents, there is increasing pressure to replace long-lived keys with short-lived access that has narrower permissions.

Status: 2026 November

In the news

Appears in 3 Agent Age stories; the curve shows weekly occurrence in the news magazine.

Hackers hit OpenCode AI coding tool, running up charges on users' AI accountsOct 19, 2026 · Code
Survey: 79% of workers have entered sensitive data into AI tools, and many use them in secretSep 21, 2026 · Work & HR
AI-related DevOps incidents nearly triple year over year, GitProtect Lab findsAug 18, 2026 · Code

Also known as

API-kulcs · API kulcs · API key · API-key · API-token · access key

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.