API Key
An API key is a long string of characters that a program uses to identify itself to an external service. It lets the provider recognize who is making the request, what that person is allowed to do, and who to bill for usage.
Many programs fetch data or computing power from an external provider on the internet. A weather app, for example, asks a weather service for the temperature instead of measuring it itself. So that the provider knows who is asking, it requires an API key. This is a long, randomly-looking string of characters, such as sk-3f9a2b7c4e81d05a. It is sent along with every request and works like a personal access code. The abbreviation API stands for Application Programming Interface: a fixed address with clear rules through which two programs communicate with each other.
The key decides who pays
Almost every AI service bills based on usage. Anyone generating text through the interface of OpenAI, Anthropic, or Google pays per processed text chunk. The API key acts as the billing address here. Every request made with that key ends up on the same account.
That’s why a stolen key is a real financial risk. There are regular cases of developers accidentally writing their key into publicly visible source code. Automated search tools find such keys within minutes. Strangers then use them for their own requests, and a bill for several thousand euros goes to the original owner.
An API key also governs what is permitted. Providers attach a limit to every key, for example a hundred requests per minute. This prevents a single user from overloading the servers. Some keys are allowed only to read, others may also modify data. Companies therefore issue a separate key per project, so that in an emergency only that one key needs to be blocked.
From creation to revocation
An API key is generated on the provider’s website, usually with a click in one’s own account. The service then rolls a long random string of characters and stores it in its database. After that, the key is often displayed in full only once. Anyone who doesn’t save it immediately has to generate a new one.
With every request, the program sends the key along in the header of the message, i.e. in an extra field next to the actual query. The provider looks up whether the key exists, whether it is still valid, and whether the account has sufficient funds. If everything checks out, the response comes back. Otherwise the server replies with an error message, often the number 401 for unauthorized.
It’s important to distinguish this from a password. A password belongs to a person, an API key belongs to a program. A password can be secured with a second confirmation via phone, an API key cannot, because there is no one behind it who could confirm anything. On the other hand, a key can be revoked at any time without affecting the user account. That’s exactly why keys are regularly rotated, often every few months.
Where API keys show up in everyday life
The topic becomes visible as soon as you build something yourself. Anyone embedding a map on their own website needs a key from Google Maps. Anyone writing a small program that queries a language model stores their key there. Ready-made tools ask for it too: some writing or coding extensions want your own AI key so that the costs land with the user.
In business news, the API key lies behind the term platform business. AI providers earn a large part of their money not from subscriptions for end users but from interface access for companies. Every issued key represents a customer whose usage can be measured. If a provider changes its per-request pricing, it immediately affects thousands of companies.
A common misconception is that an API key is a form of encryption. That’s not true. It doesn’t hide anything, it only identifies. Anyone who reads it can use it immediately. That’s why keys should never be placed in the visible part of a website or in publicly shared code, but rather in protected configuration files on the server.
