API key: what it is, how it works and how to keep it safe

What is an API key?

An API key is a secret string that identifies the application or customer calling an API, so the provider can authenticate the request, apply the right limits and bill the right account.

How API keys work

The provider generates a long random key and shows it once. The client sends it with each request, usually in a header. The server looks the key up, checks that it is active, applies its limits and records the call against its owner.

API key vs OAuth

An API key identifies an application or account and is simple to use from servers. OAuth issues short-lived tokens on behalf of a user who has granted specific permissions, which suits apps acting for many different users. For server-to-server access to a paid API, keys are common; for acting on a user’s data in another service, OAuth is the standard.

API key best practices

  • Keep keys on the server; never ship a secret key in a mobile app or browser code.
  • Use one key per integration, so you can revoke one without breaking the others.
  • Rotate keys regularly and straight away after a suspected leak.
  • Scan code and logs so keys are never committed or printed.

API key security mostly comes down to where keys live. As for where to store an API key: in an environment variable or a secrets manager, never in the source code.

Keys for paying customers

Micro SaaS API Marketplace issues keys per subscriber and counts every call per key, so each customer’s usage, limits and bill stay separate.

Last reviewed 2026-11-01.

Related terms

  • Scoped key — A scoped API key is a key that is only allowed to do specific things, such as read orders but not issue refunds, so that if it leaks, the damage is limited to what that scope allowed.
  • Rate limit — A rate limit caps how many requests a client can make to an API in a short window, such as 100 requests a minute, to protect the service from overload and abuse.
  • Sandbox — An API sandbox is a test environment where developers can call an API with realistic behaviour but without affecting real data, real money or their production quota.

All glossary terms →