Home / Knowledge hub / API key
Knowledge hub
API key
A secret string that identifies the app calling your API, and is easily leaked.
What it means
An API key is a long string that a client sends with each request so the API knows which application is calling. It works like a shared password for software. Anyone holding the string can make calls as that application, from anywhere.
That also marks its limits. A key identifies an app, not a person, and it says nothing about what a particular user may do. It is a simple tool for tracking use and controlling access, not a full answer to API authentication.
Why it matters
Keys leak constantly: committed to a public code repository, shipped inside a mobile app, pasted into a support ticket, left in front-end JavaScript. Once public, anyone can use it, and the bill, the data access and the blame land on you, often before anyone has noticed that the key left the building.
A leaked key with broad permissions is the same as a leaked admin password, but it is often overlooked because it feels like configuration. Quick revocation and narrow permissions limit the damage, and a short list of who holds which key makes revocation possible at all. Treat keys as secrets, not settings.
How it shows up
You meet keys when you call other services and when you let customers call yours. Common mistakes: one key for everything, no expiry, keys in code (hard-coded secrets), keys in URLs where they get logged, and no way for a customer to rotate theirs without downtime.
Good practice is a key per client with the smallest permissions that work, kept out of the repository, sent in a header rather than the URL, rotated on a schedule and revoked at once if exposed. Add rotation and secret scanning so a leak is caught early.
Questions people ask
API key, answered
Is an API key the same as a password?
It behaves similarly: whoever has it can use it. But a password proves a person, while a key identifies an application.
Keys are usually longer and random, and are often not tied to a specific user, so a leak can be harder to trace.
Are API keys secure enough for authentication?
For low-risk, read-only uses they can be fine. For anything that acts for a user or touches sensitive data, you need real user authentication such as OAuth tokens as well.
A key alone cannot tell you who is behind the app.
What should I do if a key leaks?
Revoke it straight away and issue a new one, then check logs for use you do not recognise. Deleting the commit is not enough, as copies persist.
Afterwards, find out how it leaked, so the next key does not follow.
Can a key be safe in a mobile or browser app?
Not as a secret. Anything shipped to a device can be extracted. Use keys there only if they are restricted to low-risk actions or specific origins, and put sensitive calls behind your own server.
Assume the key is public.
How should API keys be sent?
In a request header, over HTTPS, never in the URL. URLs end up in browser history, proxy logs and referrer headers.
Many APIs use an Authorization or custom header for this.
Sources
Where this comes from
Related
Terms that sit next to this one
API authentication
How an API decides which caller is making a request before it does anything.
Hardcoded secret
A password, API key or token written straight into source code.
Secrets management
Keeping keys, passwords and tokens out of code and in a vault.
API key rotation
Issuing new API keys on a schedule and retiring the old ones.
Secret scanning
Searching code and history for keys, passwords and tokens that should not be there.
Where could a key be sitting?
We look for secrets exposed in responses, front-end code and, in white-box mode, the repository, and show how far a leaked key reaches. Each finding is backed by what we actually exploited. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.