What is an API Key?

Unlike OAuth tokens, which are typically scoped, short-lived, and tied to a specific user's delegated permission, an API key is usually a longer-lived, coarser credential tied to an application or account rather than an individual end user. It's simple to implement — generate a key, check it on each request — which makes it popular for server-to-server integrations and simpler third-party APIs. Because an API key is a static secret, its security depends entirely on how carefully it's stored and transmitted: leaking one in a public repo, a client-side bundle, or a log file effectively hands over whatever access that key grants. Best practice treats API keys the way any password is treated — encrypted at rest, never logged, transmitted only over TLS, and rotated periodically or immediately if exposure is suspected. Many providers now support scoped or restricted API keys — limited to specific endpoints, IP ranges, or rate limits — precisely to reduce the blast radius if a key does leak, since a single unscoped key that can do anything the account can do is a much bigger liability than a narrowly permissioned one.