An API key is included with a software request so the receiving service can associate usage with an authorized account, project, quota, and billing relationship. It may grant broad or scoped access depending on the provider's credential system.
Keys must not be embedded in public client code, logs, prompts, screenshots, or ordinary project files. Secure applications store them in an approved secret system, limit their permissions, rotate exposed values, and prevent untrusted content from choosing where the credential is sent.
ELI5
An API key is a private code that lets one program prove it is allowed to use another service. The service uses the key to connect requests with the correct account, limits, and charges.
For example, a user may give a coding platform a securely stored model-provider key so requests use that user's account. Anyone who steals the key may be able to spend the quota or access permitted features, so it must be protected like a password.
