AI API Key
Also called API key, Secret key
A secret code that identifies your account to an AI provider's API, so your requests are allowed, limited and billed to you.
What is an AI API key?
An API key is a long, secret string that an AI provider gives you so your software can use its models through the API. Every request includes the key. The provider uses it to check who you are, apply your rate limits and charge your account.
Many AI tools also ask you to paste in your own key, an approach often called "bring your own key", so their features run on your account.
How does it work?
You create a key in the provider's dashboard, usually per project, and copy it once: many providers show it only at creation. Your app sends it in a request header. Keys can often be limited to certain projects, models or permissions, given spending caps, and revoked at any time.
What is it commonly confused with?
- A password. A key is meant for software, not for signing in to a website, but it should be protected just as carefully, because anyone holding it can spend your money.
- A publishable key. Some services issue keys that are safe to put in web pages. AI API keys almost never are: anything in a browser or mobile app can be read by users.
Why does it matter?
Leaked AI keys are a common and expensive mistake: bots scan public code for them and run up large bills within hours. Keep keys on a server, in environment variables or a secrets manager, never in front-end code or a public repository. Give each project its own key with only the access it needs, set spending limits, and revoke and replace a key straight away if it might have leaked. Before you give your key to a third-party tool, check what it does with it.
