Cybersecurity glossary
What is an API Key?
Learn what an API key is, how keys identify and authorize clients, how they differ from OAuth tokens, and which storage rotation and scoping practices reduce key leakage impact.
Definition
An API key is a secret identifier issued to a client application so a service can recognize the caller, apply quotas or permissions, and attribute usage—commonly sent in a header or query parameter and treated as a long-lived credential that must be protected like a password.
Why API keys matter
Integrations need a simple way to identify calling applications. An API key provides that simplicity—and that is exactly why leaks hurt. One string in a mobile app, Git repo, or screenshot can unlock billed usage and sensitive operations.
API keys remain common for server-to-server integrations, partner access, and developer platforms. They require the same discipline as any long-lived secret.
What API keys are used for
Client identification
Attribute traffic to a project, tenant, or partner integration.
Coarse authorization
Gate access to API products or environments tied to that key.
Quota and billing
Apply rate limits and usage metering per key.
Operational revocation
Disable a single integration quickly when compromise is suspected.
Typical API key lifecycle
Issue with least privilege
Create a key scoped to environments, routes, and required permissions only.
Distribute out of band
Deliver via a secrets vault or secure console—never via public chat or commits.
Store in a secrets manager
Runtime loads the key from protected configuration, not source control.
Send over TLS in headers
Present the key on each request using a dedicated header.
Monitor usage anomalies
Alert on geo spikes, new IP ranges, or sudden cost increases.
Rotate and revoke
Introduce a replacement key, migrate clients, then disable the old one.
API key vs OAuth access token
| Property | API key | OAuth access token |
|---|---|---|
| Lifetime | Often long-lived | Usually short-lived |
| User context | Typically application/project | Can represent user or client grant |
| Revocation | Key disable/rotation | Expiry, introspection, refresh reuse detection |
| Browser safety | Secret keys must not ship in frontend | Still sensitive; prefer BFF patterns |
API key security checklist
- Never commit keys; scan repositories and CI logs for accidental exposure.
- Prefer headers over query parameters to reduce leakage.
- Scope keys per environment and integration; avoid one universal master key.
- Hash or encrypt keys at rest in the authorization database where feasible.
- Rate-limit and anomaly-detect per key identity.
- Support rapid revocation and dual-key rotation windows.
- Do not rely on API keys alone for user-specific authorization.
- Treat public mobile/browser embeds as non-confidential and design accordingly.
The practical takeaway
An API key is a long-lived application credential for identifying and authorizing API clients. Convenience is not an excuse for weak handling.
Scope tightly, store secretly, monitor continuously, and rotate on schedule—and escalate to OAuth-style tokens when user delegation or short lifetimes are required.
Related security terms
Access Token
Short-lived OAuth credential often preferred over static keys for user context.
API Abuse
Misuse patterns frequently enabled by leaked or over-privileged keys.
Rate Limiting
Quota enforcement commonly tied to API key identity.
Credential Stuffing
Related credential abuse; leaked keys are similarly replayed at scale.
Broken Authentication
Failure class that includes weak API key handling.
Frequently asked questions
What is an API key in simple terms?
It is a secret string your app sends so the API knows which project or customer is calling. Think of it as a long-lived password for software, not for a human login form.
Is an API key the same as an OAuth access token?
No. API keys are usually static project credentials. OAuth access tokens are typically short-lived, scoped, and tied to a user or client grant.
Where should API keys be sent?
Prefer request headers over query strings. Query parameters leak into logs, browser history, and referrer headers.
Can browsers safely hold API keys?
Public browser code cannot keep a confidential key secret. Use a backend or BFF to hold secret keys, or use public keys with strict referrer and rate controls.
What happens if an API key leaks?
Attackers can consume quota, access data allowed by the key, and rack up costs until the key is rotated and old access is revoked.
Should every endpoint accept API keys?
Only where that auth model fits. User-specific data usually needs user authentication and authorization beyond a shared project key.
How often should keys be rotated?
On a planned schedule and immediately after suspected exposure, with overlapping grace periods so clients can switch without downtime.
References
Explore authoritative guidance and frameworks related to api key.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.