Clicked Gallery

What is an API key?

Highlighted from a real engineering doc. Explained by Clicked.

Used in a sentence

Engineering Notes · AI Systems

The tutorial warned readers never to paste an API key into client-side code, where anyone reading the page can see it.

The reader highlighted one word in the docs. Clicked explained the technical term “API key” in simple terms:

Explained in three depths

Same facts, different vibe — Slang mode 😎

The Clicked way

●○○

Overview

An API key is a string of characters an app sends along with every request to an API, so the service knows which account is calling. It works like an account number rather than a password: nobody is asked who they are, and whatever holds the key is treated as the owner. That is why keys are kept out of public code, and why the fix for a leaked one is to cancel it and issue another.
●○○

Overview

An API key is caller ID for software. Every request turns up with your key attached, the service decides that's you, and your account gets charged, and at no point does anyone check who is holding the phone. So a key sitting in public code isn't waiting to be stolen. It has already been handed out, and whoever copies it gets served as you. 😎

A quick take — often all you need.

●●○

Detail

An API key identifies the account behind a request. A company that wants data or computing time signs up with the service that sells it and receives a key. On every call the service looks the key up, finds that company's account, and applies its permissions and its billing. A key is not a password. Nobody types it in, and cancelling one locks nobody out: an account can hold several keys, one per app, and each can be revoked and replaced on its own. A key is built to be thrown away. Despite the name, it also locks nothing and encrypts nothing. It is simply a name the service recognises, so where the company keeps it matters more than anything else about it. A website or a phone app is downloaded onto the user's machine, so a key written into it arrives there too, where anyone curious enough to look can read it. The key stays on the company's own server instead: the app asks the server, and the server holds the key and calls the API. A leaked key gets found and spent quickly, and the bill goes to the company that registered it.
●●○

Detail

An API key is a string that means "bill this account", so the only question that matters is who ends up holding the string. Two places give it away. Publishing is the loud one. Bots watch public code for anything key-shaped, and a key pushed by mistake is often being spent within minutes. Nobody broke in. Shipping is the quiet one. Whatever goes into an app, the person using that app has a copy of, and they can go and look, however deeply it was buried. That leaves one safe home for a secret key: a machine your users never touch. Your server holds the key, the app asks your server, and your server calls the API. The reassuring part is that keys are replaceable and extra ones are free. Cancel the leaked one, issue another, carry on. Give every app its own and a leak stops being a whole-system problem: you already know which app had that key, so you kill one and everything else keeps running. It still costs real money until you do. 😎

Want more? One click digs deeper.

●●●

Analogy

An API key is the toll tag on a car windscreen. The toll reader never looks at the driver. It reads the tag as the car passes and bills the account the tag is registered to. Lend the car out for a week and the charges are still yours. Lose the tag and whoever sticks it to their own windscreen drives on your account until you phone in and have it cancelled, which takes minutes and changes nothing about the car. The whole arrangement sits in one object: it names an account rather than a person, it buys access rather than secrecy, and it is meant to be replaceable.
Deepest level reached.
●●●

Analogy

An API key is an open tab, at a bar that has never once looked at your face. You gave a name, they wrote it down, and from then on anyone who says the same name gets served and you get the total. Tell one friend and it works fine. Tell the whole street and you find out at closing time. Notice what fixes it, though. You don't change your name, move house or stop going out. You close the tab and open another one. That is a key exactly: useless as protection, excellent as an account, replaceable in about a minute. 😎
Deepest level reached.

Unfamiliar concept? A real-world example makes it click — fresh analogies on tap.

AI explanations may contain errors · Not professional advice

Formal definition — The same term, explained the usual way

An API key is an opaque identifier issued by a service provider and transmitted with each request, usually in an HTTP header, to identify the calling application and associate the request with an account for authorization, rate limiting and billing. It provides identification rather than user authentication and applies no cryptographic protection to the request itself, so it is paired with TLS in transport and with scoping, expiry and rotation in management. Providers commonly distinguish publishable keys, which may appear in client code and are constrained by domain or referrer restrictions, from secret keys, which are held server-side and are revoked and reissued on disclosure.

Want Clicked to explain terms like “API key” directly in your browser — including on PDFs?

Add to Chrome — Free

50 free Explanations · No credit card required