What Is an API Key? (And How to Keep It Secret)

Almost every service you integrate with hands you an API key. They're simple in concept but easy to mishandle — leaked keys are one of the most common causes of breaches. Here's what an API key is and how to treat it responsibly.

What is an API key?

An API key is a long, random string that identifies and authenticates an application (not a person) when it calls an API. The server checks the key on each request to decide whether to allow it and which account it belongs to. Think of it as a password for a program — a secret that proves "this request is authorised."

API key vs password vs token

• Password — authenticates a human; meant to be memorised; should be hashed at rest.
• API key — authenticates an application; long and random; usually long-lived until rotated.
• Token (e.g. JWT) — often short-lived, may carry claims, and is issued after an auth step. See our JWT guide.

Unlike a password, nobody needs to remember an API key, so it should be as long and random as practical.

How much randomness does a key need?

Security comes entirely from the key being unguessable. Aim for at least 128 bits of entropy; 256 bits is a comfortable margin for long-lived keys. In practical terms that's roughly 32 hex characters or about 22 Base64url characters. Generating keys from a cryptographic random source — not a human-chosen phrase — is essential.

What about prefixes?

Many providers prefix keys to make them recognisable: Stripe uses sk_live_, GitHub uses ghp_. The prefix adds no security, but it helps humans and automated secret-scanners spot a leaked key instantly. The random body is what protects it.

Best practices for handling keys

• Never commit keys to source control. Leaked Git history is a top source of exposed secrets — and bots scan public repos within minutes.
• Don't log them. Keys in log files or error messages are a common silent leak.
• Store them in environment variables or a secrets manager, not in code or config files checked into the repo.
• Scope and limit them. Use the narrowest permissions and, where possible, restrict by IP or domain.
• Rotate regularly and immediately after any suspected exposure. Treat rotation as routine, not an emergency-only action.

If a key leaks

Revoke it immediately, issue a new one, and check the provider's logs for unauthorised use. Because keys are long-lived, a leaked key can be abused until it's revoked — speed matters.

Try it

Generate cryptographically strong keys — in hex, Base64url or alphanumeric, with an optional prefix — using our API key generator, which shows the entropy for your settings. For human passwords instead, see the password generator.