What is an API Key? Definition, Use and Security

What is an API key?

An API key is a secret string that identifies the application or user calling an API. The server looks the key up on every request to decide who is calling, which limits apply and what to bill. It is the simplest form of API authentication, but it is a single shared secret: whoever holds the key can act as its owner.

How an API key works

The provider generates a long random key and shows it once. The client keeps it and sends it with every request, usually in a header. The server compares it with what it has stored, then allows, limits or rejects the call.

GET /v1/orders HTTP/1.1
Host: api.example.com
X-API-Key: sk_live_EXAMPLE_NOT_A_REAL_KEY

OWASP's REST security guidance says API keys and tokens should not appear in the URL because it can be captured in web server logs.

Generating and storing keys

Treat a key like a password. Generate it from a cryptographically secure random source, show it to the user once, and store only a hash on the server. A fast hash such as SHA-256 is enough for a long random key, and if your database leaks the attacker still cannot use the keys.

import crypto from 'crypto';

const key = 'sk_live_' + crypto.randomBytes(24).toString('hex');
const hash = crypto.createHash('sha256').update(key).digest('hex');

// show `key` to the user once, store only `hash` in the database
await db.apiKeys.insert({ userId, keyHash: hash });

API key vs OAuth and JWT

An API key identifies an application, not a person, and it rarely expires on its own. That is why OWASP cautions against relying exclusively on API keys to protect sensitive or high-value resources.

API key security best practices

• Keep keys secret. Never commit them to git, paste them into tickets or screenshot them. Load them from environment variables or a secrets manager.
• Use separate keys per environment and per integration, so one leak has a small blast radius.
• Give each key the least privilege it needs, for example read-only.
• Restrict where it works with an IP allowlist or an allowed-origins list where the provider supports it.
• Rotate on a schedule and on suspicion. Issue the new key, accept both for a short overlap, move clients over, then revoke the old one.
• Rate-limit and log usage per key so abuse and leaks show up as anomalies. See API abuse.
• Always use HTTPS, so the key is protected in transit.

Common API key mistakes

• Embedding a server key in front-end JavaScript or a mobile app, where anyone can extract it.
• Leaving a key in git history. Deleting the file does not remove it: rotate the key.
• Sending keys in URLs, which proxies, browsers and analytics tools log.
• Using one all-powerful key for every service and environment.
• Storing raw keys in the database instead of hashes.
• Sharing keys over chat or email instead of a secrets vault.

Testing and monitoring APIs that use keys

Keys shape how you test an API. Use a dedicated test key, ideally against a staging environment, so a load test does not burn through a production quota or trigger a real customer's rate limit. If the provider limits requests per key, a single key will hit that limit long before your servers do, so check what the limit is first. The post on common causes of API rate limiting covers this, and how to load test RESTful APIs with LoadFocus walks through a first run.

You can add the key header to a one-off request with the free curl online tool, and to scheduled checks with LoadFocus API monitoring, which supports custom headers and runs checks every 5 minutes on the free plan. For the endpoints a key unlocks, see API endpoints, and for the wider picture API security.

FAQ: API keys

Are API keys secure?

They are weaker than OAuth 2.0 or mutual TLS because one secret is the whole proof. They are acceptable for low-risk, server-to-server use when combined with HTTPS, narrow permissions, rate limits and rotation.

What is the difference between an API key and a bearer token?

An API key identifies an application and usually lives until you rotate it. A bearer token is a credential, often short-lived and tied to a user and a scope, issued through a flow such as OAuth 2.0. Many APIs send both in the same header.

How do I rotate an API key?

Create a new key, let the API accept both for a transition period, switch every client to the new one, then revoke the old key.

Where should I store API keys?

In a secrets manager or environment variables on the server, never in source code or in a client app. Provider-side, store only a hash.

Can I use an API key in a mobile app?

It can be extracted from the app binary, so treat it as public. Restrict it as tightly as the provider allows, or route calls through your own backend and keep the real key there.

How do I find a leaked API key?

Run a secret scanner such as GitHub secret scanning or gitleaks over your repositories and history, and watch per-key usage for unusual volume or locations. Rotate any key that leaked.