API Key
A unique identifier used to authenticate a user, developer, or calling program to an API.
Detailed Explanation
API keys are a simple way for a service to know who is making a request. While convenient, they are less secure than OAuth tokens because they are often long-lived and have broad permissions. API keys should be treated as sensitive secrets and should never be exposed in client-side code (like frontend JavaScript).
Quick Summary
An API key is a long, opaque string used to identify and authenticate a calling application or developer to an API. It's the simplest auth model, and the easiest to leak.
Key Takeaways
- Treat as a secret: store in environment variables or secret managers, never in source control.
- Scope and rotate: each key should grant minimum permissions and be rotatable without downtime.
- Server-side only, exposing API keys in frontend JavaScript is the most common leak.
- Log usage by key so abuse, abandoned keys, and rotation gaps are visible.
- Prefer OAuth tokens or short-lived signed credentials when you need real per-user authorization.
When to use it
- Server-to-server API access (your backend calling Stripe, OpenAI, Twilio).
- Identifying a customer or tier on a public API for rate limiting and metering.
- Webhook signing where the receiver verifies the sender by shared secret.
- Quick prototypes before investing in full OAuth flows.
Common Mistakes
- Committing keys to GitHub, secret scanners constantly find these within minutes of push.
- Embedding API keys in mobile apps or SPAs, where they can be extracted from the binary or DevTools.
- Using one key for all environments; staging leaks become production leaks.
- No expiry and no rotation policy, a key from 2019 is still active because nobody knows what depends on it.
API Key, Frequently Asked
API key or OAuth?
API key for server-to-server when you control both ends and the caller is the resource owner. OAuth (or OIDC) when end users delegate access to a third-party app, or when you need per-user scopes. The two often coexist.
What do I do if a key leaks?
Rotate immediately, revoke the old key, issue a new one, redeploy. Then audit logs for use of the old key during the exposure window. Rotation should be a single command you've practiced, not a fire drill.