API Key — AI Glossary

Reference details

Related terms

• SDK (Software Development Kit)
• Rate Limiting
• OpenAI API

How it works

1. The key is a bearer credential: possession alone authorises the request, with no challenge, no expiry by default and no proof of who is presenting it.
2. It is transmitted in a request header, so it is exposed to anything that can read the request — logs, proxies, error reporters and any client-side code it is embedded in.
3. Billing and quota attach to the key, which is what makes it an accounting identity as well as an authentication one, and why a leaked key is a financial exposure rather than only a data one.
4. Secrets managers and environment variables keep it out of source control, which is the single highest-value control because committed keys are discovered by automated scanning within minutes.
5. Scoping — per service, per environment, per project — determines the blast radius of a leak and the cost of rotation, and this is the decision most often made by default rather than deliberately.
6. Rotation is only operationally feasible if scoping made it cheap, which is why the two are one decision rather than two.

Example: Why scoping and rotation are the same decision

Take one key shared by 12 services. A leak compromises all 12 at once, and rotating it means 12 coordinated deployments that must land close enough together that no service is left holding the revoked value — which in practice means a maintenance window, which in practice means the rotation is deferred. Now give each service its own key. A leak compromises 1 service, rotation is 1 deployment, and it can happen this afternoon with no coordination: the blast radius fell by a factor of 12 and the rotation cost fell by the same 12. The same arithmetic explains why per-environment separation matters independently — a development key in a repository that also compromises production is a single mistake with two consequences. The general shape is that a shared credential makes every incident maximally wide and every remedy maximally expensive, so the two properties compound in the wrong direction. Scoping is cheap to do at the start and requires an inventory and a migration later, which is the usual reason it is not done.

Commonly confused with

An API key is not a user identity, and systems that treat it as one build authorisation on the wrong primitive. A key identifies an account for billing and quota; it says nothing about which person or request is behind a call. So per-user authorisation, audit attribution and rate limiting must be implemented by the application in front of the key rather than derived from it. The related confusion is with a session token: a session token is short-lived, scoped to an authenticated user and expected to expire, while an API key is long-lived by default and expires only when someone rotates it.

When to use it

Reach for it when:

• Server-side service-to-service calls, which is the only place a bearer credential belongs.
• Scoped per service and per environment, so a leak is narrow and rotation is one deployment.
• In a secrets manager with rotation already exercised, since an untested rotation path is not a rotation path.
• With provider-side restrictions applied where available — spend caps, usage limits, address allowlists.

Reach for something else when:

• In client-side code or a mobile application, where it is extractable regardless of obfuscation.
• Shared across services or environments, which maximises both blast radius and rotation cost.
• As a user identity for authorisation or audit, which it cannot provide.
• Committed to source control under any circumstances, including private repositories, since history outlives the decision to make them private.

Continue your research

Use these connected ModelRefs sections to compare alternatives, inspect implementation paths, and review the evidence and governance boundaries relevant to API Key — AI Glossary.

• Browse models
• Review providers
• Inspect benchmarks
• Explore workflows
• Learn AI concepts
• Read decision guides
• Review trust and methodology
• Start a decision path