API Key

An API key lets one software system identify itself when calling another service. Website map widgets, email integrations, analytics tools, and payment-related services may all use keys, but the protection they provide depends on how the receiving system validates them. Some keys identify a project for billing or rate limits; others permit sensitive actions. A key is not automatically the same as a user password or a complete authorization model.

Keys with sensitive privileges should be stored outside public source code and browser bundles when possible, restricted to the minimum permissions and allowed origins or services supported by the provider, and rotated when exposed. Administrators need an inventory showing who owns each key, what it enables, where it is used, and how to revoke it without breaking critical workflows. A restricted public client key can be appropriate for specific products, but its exposure and limitations must be understood.

OWASP treats API keys as secrets when they protect access and recommends controlled storage, rotation, monitoring, and lifecycle management. For a service business, forgotten keys in a former contractor's automation can create unexpected cost or data exposure. API keys enable integrations; they do not replace sound identity, access control, or monitoring.