If you've used a weather app, sent a message through a third-party service, or connected two pieces of software, you've used an API. And behind almost every API is an API key — a string of characters that tells the service who you are and whether you're allowed to use it. This guide explains what API keys are, how they work, and how to handle them safely.
What is an API?
An API (Application Programming Interface) is a way for software to talk to other software. When you check the weather on your phone, the app sends a request to a weather service's API and gets back data. When Stripe processes a payment, your website sends a request to Stripe's API. APIs are everywhere.
Most APIs are protected — not everyone should be able to send them requests. The primary mechanism for controlling access is the API key.
What is an API key?
An API key is a unique identifier — typically a long random string — that you include in requests to an API to prove who you are. Think of it like a password for your application rather than for a person.
Example API keys (different formats):
sk_live_a3f8c2d19e4b7f0a1d6e8c4b2f9d5e3a7b0c1d2e3f4a5b6
AIzaSyD-9tSrke72I6e98xmkGDmFGHjK8f4cVhA
Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
How API keys authenticate requests
When you make a request to an API, you include your key in one of three places:
1. HTTP Header (most common)
Authorization: Bearer sk_live_a3f8c2d19e4b7f...
or
X-API-Key: a3f8c2d19e4b7f0a...
2. Query parameter (convenient but less secure)
Risk: API keys in URLs can appear in server logs and browser history.
3. Request body
{
"api_key": "a3f8c2d19e4b7f0a",
"query": "weather"
}
The API server receives the request, looks up the key in its database, and either grants access or returns a 401 Unauthorized error.
API key vs password vs OAuth token
| Type | Identifies | Typical use | Expires? |
|---|---|---|---|
| API Key | An application | Server-to-server calls | Rarely (manual rotation) |
| Password | A person | User login | No (until changed) |
| OAuth token | A person's permission | Third-party access | Yes (hours/days) |
| JWT | Claims (user/app) | Stateless auth | Yes (configurable) |
Types of API keys
- Public keys — Identify your application but don't grant sensitive access. Often used in client-side JavaScript (like Google Maps API keys). These are visible to anyone who views your page source, so they're typically restricted by domain or referrer.
- Secret keys — Grant full or elevated access. Must be kept server-side only and never exposed in client code. Stripe's
sk_live_keys are an example. - Scoped keys — Limited to specific operations (read-only, specific endpoints). Best practice for the principle of least privilege.
- Rotating keys — Some systems issue short-lived keys that must be periodically refreshed using a longer-lived refresh token.
What makes a good API key?
A secure API key should have:
- Sufficient entropy — At least 128 bits (16 bytes) of cryptographic randomness, ideally 256 bits (32 bytes). This makes brute-force guessing computationally infeasible.
- URL-safe characters — Hex (0-9, a-f) or Base64URL (A-Z, a-z, 0-9, -, _) to avoid encoding issues in headers and URLs.
- A meaningful prefix — Like Stripe's
sk_live_or OpenAI'ssk-. Prefixes help users identify key types and enable automated secret scanning. - Cryptographic source — Generated with
crypto.getRandomValues()in browsers orcrypto.randomBytes()in Node.js — notMath.random().
Critical security rules for API keys
✓ Never commit API keys to version control
GitHub, GitLab, and Bitbucket scan public repositories for exposed keys. Many developers have been compromised within minutes of accidentally committing a secret key.
✓ Store keys in environment variables
Use .env files locally (never commit them) and environment variable management in production (AWS Secrets Manager, Doppler, Vercel env vars, etc.).
✓ Use different keys per environment
Your development key should be separate from your production key. A compromised dev key won't affect production.
✓ Restrict key permissions
Use the minimum permissions necessary. A read-only key that can't charge cards or delete data limits your exposure if it's leaked.
✓ Rotate keys regularly
Establish a rotation schedule (quarterly for critical keys) and rotate immediately if you suspect a key was exposed.
Generate a secure API key
Our API Key Generator creates cryptographically secure keys using crypto.getRandomValues(). Choose your format (hex, Base64URL, alphanumeric), length, and optional prefix. Everything runs in your browser — nothing is stored or sent to any server.
Frequently asked questions
How does an API server store keys securely?
A well-designed API stores a hash of the key (typically SHA-256 or bcrypt), not the key itself. When you make a request, the server hashes your provided key and compares it to the stored hash. This means even if the server's database is stolen, attackers can't recover the actual API keys.
What should I do if an API key is leaked?
Revoke it immediately through the API provider's dashboard, then generate a new key and update all services using the old one. Check the API's access logs for any unauthorized usage during the exposure window and report the incident to the provider if sensitive data was accessed.
Can API keys expire?
It depends on the implementation. Most API keys don't expire automatically — they remain valid until you manually revoke them. Some systems issue short-lived tokens (like OAuth access tokens) that expire in hours or days and must be refreshed. Short-lived tokens are more secure because a leaked token becomes useless quickly.
Is an API key the same as an auth token?
Similar but not identical. An API key typically identifies an application and has no expiry. An auth token (like an OAuth access token or JWT) is usually shorter-lived, tied to a specific user's authorization, and designed to be refreshed periodically. Many modern systems use both: an API key to authenticate the application and a user token to authorize actions on behalf of a specific user.