An application programming interface key lets a service associate programmatic requests with a customer, project or account. Providers use it to apply permissions, usage limits, billing and audit records to calls made by software rather than a person using an interactive login.
Keys should be treated as secrets. They belong in protected configuration or a secret manager, should receive only the access required and must never be exposed in public source code, browser content or logs.
