← Back to glossary
🗝️

API Key

Security

Authorization Rate Limiting Access Control

Static credential used to authenticate/identify an API client; should be scoped, rotated, and protected.

Definition

API keys are often long-lived secrets used for client identification and access. They should be treated like passwords: stored securely, rotated, limited by scope/IP, and monitored for misuse.

In plain English Static credential used to authenticate/identify an API client; should be scoped, rotated, and protected.

Why this matters

Why it matters: Leaked keys enable abuse (fraud, scraping) and may expose data depending on permissions.

Example

Example: Use separate keys per environment, restrict by scope, rotate regularly, and enforce rate limits and alerting.