AI Vocabulary · 04 Building with AI
What is API Key?
A secret password that lets software use a service on your account, and charges that account for it.
An API key is a long secret string that identifies you to a service when software calls its API. Whoever has the key can use the service as you, and the bill goes to your account. With model providers, a leaked key can mean someone else running up large AI costs in your name.
That is why keys must stay secret. Never paste them into a chat with an AI, into a shared document, or into code that ends up in a repository, especially a public one, where automated bots scan for keys within minutes. Store them in environment variables or a secrets manager instead.
Why it matters for you
Leaked keys are one of the most common and expensive beginner mistakes when building with AI. They are also a route to data leakage if the key gives access to your data.
Own it
Create separate keys per project, give each only the permissions it needs, set spending limits with the provider, and rotate a key immediately if you suspect it was exposed. Know which keys exist and who holds them.
Where it comes from
API keys have no single inventor. They grew up with public web APIs in the 2000s, when services opened their data and functions to outside developers and needed a simple way to know who was calling and how much. The idea stayed simple on purpose: a long secret string sent with each request, which is also why it must be guarded (Wikipedia).
Related
Your AI Learning Hub
Learn the whole AI Vocabulary, step by step, and build with it. Build it. Own it.