What is an API Key?
A secret credential that identifies you when your code calls an AI service.
Definition
An API key is a secret string of characters that identifies you or your application when your code sends requests to a service's API. For AI services, the key tells the provider which account is making each request, so it can check permissions, apply rate limits and bill for usage. Anyone who holds your key can usually make requests charged to your account, so it must be kept as private as a password.
How it works
You create a key in the provider's developer dashboard, usually after setting up billing. Your application then sends the key with every request, typically in an HTTP header. The provider looks up the key, confirms it is valid and active, checks the limits attached to it, processes the request and records the tokens or other units used. You can usually create several keys, give each one a name or restricted permissions, set spending limits, and revoke a key instantly if it leaks.
💡 Example
A developer building a support chatbot creates a key in an AI provider's dashboard and stores it as an environment variable on her server, never in the website code. Her server adds the key to each request sent to the model. Months later a teammate accidentally pushes a test file containing an old key to a public repository, so she revokes that key and issues a new one within minutes.
Why this matters
API keys are how you use AI models beyond chat apps: in your own software, automations, coding assistants and multi-model chat interfaces. Many tools ask you to bring your own key, which means you pay the model provider directly for usage. A leaked key can run up large bills or expose data, so knowing how to store, rotate and limit keys protects both your budget and your users.
Tools that use this concept
API keys are central to how these tools work, as their ToolChase reviews explain.
Related concepts
A way for developers to programmatically access AI models in their own applications.
The basic unit of text that AI models process, roughly 4 characters or 0.75 words.
The process of running a trained AI model to generate predictions or outputs.
What is an API Key?
An API key is a secret string of characters that identifies you or your application when your code sends requests to a service's API. For AI services, the key tells the provider which account is making each request, so it can check permissions, apply rate limits and bill for usage. Anyone who holds your key can usually make requests charged to your account, so it must be kept as private as a password.
How does API Key work in practice?
A developer building a support chatbot creates a key in an AI provider's dashboard and stores it as an environment variable on her server, never in the website code. Her server adds the key to each request sent to the model. Months later a teammate accidentally pushes a test file containing an old key to a public repository, so she revokes that key and issues a new one within minutes.
How should you store an API key securely?
Keep keys on a server or in a secrets manager, load them through environment variables, and never paste them into front-end code, public repositories, screenshots or shared documents. Use separate keys for different projects, give each the minimum permissions it needs, set usage limits and rotate keys regularly.
What should you do if an API key is leaked?
Revoke or delete the key in the provider's dashboard immediately, then create a new one and update your applications. Check your usage and billing for unexpected activity, and find out how the key was exposed so it does not happen again.
What does bring your own key (BYOK) mean?
Bring your own key means a tool lets you enter an API key from an AI provider instead of paying the tool for model usage. Requests run on your own provider account, so you pay the provider directly for what you use and can choose which models to connect.