An API key is included with a software request so the receiving service can associate usage with an authorized account, project, quota, and billing relationship. It may grant broad or scoped access depending on the provider's credential system.
Keys must not be embedded in public client code, logs, prompts, screenshots, or ordinary project files. Secure applications store them in an approved secret system, limit their permissions, rotate exposed values, and prevent untrusted content from choosing where the credential is sent.
ELI5
An API key is a private code that lets one program prove it is allowed to use another service. The service uses the key to connect requests with the correct account, limits, and charges.
For example, a user may give a coding platform a securely stored model-provider key so requests use that user's account. Anyone who steals the key may be able to spend the quota or access permitted features, so it must be protected like a password.
Can an API key be placed in browser JavaScript?
A secret provider key generally should not be shipped to public browser code because visitors can inspect and reuse it. A protected server-side boundary is normally required.
What should happen if an API key is exposed?
Revoke or rotate it promptly, remove it from visible or tracked locations, inspect usage and logs for misuse, and correct the storage or delivery path that leaked it.
