API key

Checked 26 October 2026 · by A.Frick

In plain words

An API key is a long string of letters and digits. When a program sends a request to an AI service, it adds the key. The provider reads it, knows which account or project to charge, and answers. The key works like a password and a credit card in one: whoever holds it can use your quota and run up your bill.

An API key is not the same as a chat subscription. A paid chat plan and an API account are billed separately. The page subscription vs API explains the difference, and AI subscriptions lists the plans.

Why it matters

• Money: A leaked key can be used by strangers. Charges land on your account until you stop it.
• Data: Anyone with the key can send requests in your name, which may touch your projects and settings.
• Basic rules from the providers: OpenAI's guidance says to avoid exposing keys in code or public repositories and to store them in a secure place. Google's Gemini docs have a section on security and secret management with the same aim.

What to do:

1. Keep the key out of your code, screenshots, chats and public repositories. Use an environment variable or a secret manager.
2. Use one key per project, so you can revoke one without breaking the rest.
3. Never put a key in a web page or mobile app that users can inspect. Call the AI service from your own server instead.
4. Set a spending limit. Anthropic, for example, lets you set your own monthly spend limit below your tier's cap, and once it is reached, requests fail until the limit is raised or the month turns. See how to create an API key with a spending limit.
5. If a key leaks, revoke it at once, create a new one and check your usage.

Example

A developer commits a small script to a public code site. The script contains the key as plain text. Within hours, automated scanners find it and use it. The developer sees an unexpected bill. A key read from an environment variable, with a low spending limit, would have limited the damage.

Common misconceptions

• "A private repository is safe enough." Repositories can become public, be copied or be shared. Keep keys out anyway.
• "The provider will refund any misuse." Policies differ. Do not count on it.
• "A key is a login." It has no person behind it, so no second factor protects it. Guard it like a secret.