# API key

> A secret string that identifies your app when it calls someone else's API.

- Level: Intermediate
- Topics: Security, Software
- URL: https://tidbit.legios.com.ar/api-key/
- In Spanish: [Clave de API](https://tidbit.legios.com.ar/es/api-key/)

An **API key** is a long, random-looking string, something like `sk_live_4f9a…`, that a service gives you so your program can use its API. Every request your code sends includes the key, usually in a header, and the service uses it to know who is calling: which account to bill, which limits apply and what that caller is allowed to do.

Because whoever has the key can act as you, it works like a password. If one leaks, a stranger can run up your bill on a paid AI or maps API, read your data or send messages in your name. The most common leak is a key written directly in the code and pushed to a public GitHub repository; automated bots scan for exactly that within minutes.

Good habits follow from that. Keep keys out of the code, in environment variables or a secrets manager such as AWS Secrets Manager. Never put a secret key in a website's or mobile app's code, since anyone can read it there; call the API from your server instead. Give each key only the permissions it needs, use separate keys for testing and production, and **rotate** them: create a new one, switch over, and revoke the old. Keys identify a program; for acting on behalf of a person, services use OAuth tokens instead.

## An analogy

Like the badge a contractor gets at an office building. It opens the doors they need and logs every entry under their company's name, so if they lose it, you deactivate it and print a new one.

## Keep in mind

- Identifies the calling app and its account, often for billing and limits.
- Treat it like a password: anyone holding it can use it.
- Store it in environment variables or a secrets manager, never in code.
- If it leaks, revoke it and create a new one right away.

## Go deeper

- [What is an API key? (AWS)](https://aws.amazon.com/what-is/api-key/)
- [Manage API keys (Google Cloud docs)](https://cloud.google.com/docs/authentication/api-keys)
- [Secrets Management Cheat Sheet (OWASP)](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)

## Related terms

- [API](https://tidbit.legios.com.ar/api/): The menu of things one program lets another program ask for.
- [Artificial intelligence](https://tidbit.legios.com.ar/artificial-intelligence/): Getting computers to do things that, until recently, only people could do.
- [GitHub](https://tidbit.legios.com.ar/github/): A website where teams store their code with Git and work on it together.
- [Environment variables](https://tidbit.legios.com.ar/environment-variables/): Named settings a program reads from outside its code, like where its database lives.
- [AWS Secrets Manager](https://tidbit.legios.com.ar/aws-secrets-manager/): A locked vault for passwords and API keys, so they never live in your code.
- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [OAuth and SSO](https://tidbit.legios.com.ar/oauth-and-sso/): Log in once with an account you trust, and let it vouch for you in other apps.
- [Token](https://tidbit.legios.com.ar/token/): The small chunk of text a language model actually reads.