Glossary · Security
API Key
A secret credential string used to authenticate a calling application to an API, granting it access to that service's resources.
Browse all definitionsIn detail
An API key is a long random string (often 32 to 64 characters) that acts as a password for machine to machine authentication. The calling application includes the key in the HTTP request header or query string, and the API service validates it and grants access. API keys differ from OAuth tokens in that they typically represent the application rather than a specific user, and they do not expire unless explicitly rotated. AI providers (Anthropic, OpenAI), cloud platforms (AWS, GCP), payment processors (Stripe) and most SaaS APIs all use keys. A leaked API key is a credential leak. The holder can consume your quota, access your data and incur charges.
Sources & further reading
Check the source, not just the summary
- Veracode 2025 GenAI Code Security Reportveracode.com
Apply the definition
Want to talk through how this applies to your business?
Start with the decision in front of you. We will help map the fit.