Skip to main content
All glossary terms

Credentials & security

API key

An API key is a secret or identifier used by an application to present a credential to an API. Depending on the service, it may identify a client, authorize selected operations, or both; possession can be sufficient for use, so handling and scope matter.

Also known as API credential.

Why it matters in practice

Keys are commonly sent in a header or another documented request field and should be protected from source control, logs, and unintended clients. A key for an upstream API is not the same credential used to authenticate to a forward proxy. Storage, rotation, and permissions should match its intended purpose.

Example

A worker sends a placeholder-backed key to api.example.com in the header required by that service, without placing the value in its repository.

Educational note

This definition is general information, not legal advice. It may omit facts that matter to a specific situation and does not establish or guarantee compliance.