What is an API key?
An API key is a credential, usually a long random string, that an app presents when calling an external service. It tells the service who's calling, which account to bill, and what the caller is allowed to do. Keys come from the service's dashboard: signing up for an AI model provider, Stripe, or a maps service produces a key to copy into the project's configuration.
The key is the link between code and account. The app is disposable; the key is attached to real billing and real access.
Why must API keys stay secret?
Because possession is permission. Anyone holding a key can make requests as its owner: running up model-usage bills, sending email from the app's identity, or reading data the key can reach. Leaked keys get found fast, since automated scanners continuously crawl public code for key patterns.
The classic exposure is a key hardcoded into frontend code, where every visitor's browser downloads it. The safe pattern is the opposite: keys live in environment variables and are used only server-side, so they never leave infrastructure the builder controls.
How should API keys be handled day to day?
Three habits cover most of it. Store keys in environment variables from the first day, not "after cleanup." Set a spending limit at each service that bills per use, so a leak or a bug has a ceiling. And when a key might have been exposed, revoke it at the dashboard and issue a fresh one; deleting it from the code doesn't recall the copies.
Services increasingly help: many issue keys with scoped permissions and support rotation, and asking the AI to "scan the project for hardcoded keys" is a one-line audit.
