What is API Key?
A static secret token that identifies and authenticates a calling application to an API, simpler but less flexible than OAuth.
Definition
An API key is a long random string issued to a client and presented on every request, usually in a header like Authorization: Bearer or X-API-Key. It identifies the calling application — enabling per-key rate limits, usage billing, and revocation — and works well for server-to-server integrations like Stripe or SendGrid. Keys are weaker than OAuth for user-level authorization: they don't expire by default, carry no scoped consent, and identify an app rather than a person. Operational hygiene matters most: never embed keys in frontend code or Git history, store them in a secrets manager, rotate them, and scan repositories with tools like Gitleaks.