An API key is a long secret string a program sends with each request to prove which account is calling a service, such as a payment, maps or email provider. Treat most keys like a password: keep them on a server, never in website code, limit what they can do, and replace them if exposed.
| API key | OAuth access token | Password | |
|---|---|---|---|
| Who uses it | Your own code or server | An app acting for a user who approved it | A person signing in |
| How you get it | Copy it from the provider's dashboard | Issued after the user clicks Allow | Chosen by the person |
| Typical lifetime | Until you rotate or delete it | Short, then refreshed | Until changed |
| Scope | Whatever you allowed when creating it | The permissions the user granted | Everything the account can do |
Updated
If you run a website or store, you meet API keys whenever you connect a service: payments, maps, email, a form tool or an AI agent. Most are secret, a few are meant to be public, and mixing them up is how bills and data leaks happen. Paste a key into the inspector below to see what kind it looks like; it runs entirely in your browser and sends nothing anywhere.
Paste a key or just its first few characters. The check runs in your browser only; still, prefer a test key or a dummy value over a live secret.
Paste something to inspect.
The key lives in an environment variable on the server. The browser calls your own endpoint, which adds the key and calls the provider.
Placeholder values only. Add .env to .gitignore so it never reaches your repository.
# .env
PAYMENTS_SECRET_KEY=sk_test_your_key_here
MAPS_BROWSER_KEY=your_restricted_browser_keyA tiny server route. The secret is read on the server and never sent to the browser.
export default async function handler(req, res) {
const r = await fetch("https://api.example.com/v1/quotes", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.PAYMENTS_SECRET_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({ amount: Number(req.body?.amount) || 0 }),
});
res.status(r.status).json(await r.json());
}Some services issue a pair. A publishable key identifies your account from the browser but cannot do anything sensitive, while the secret key on your server can charge cards or read data. Stripe's docs mark only the publishable key as safe to expose.
A browser key is still worth restricting. Google Cloud's guidance is to add API key restrictions, which limit the ways a key can be used and so reduce the harm if someone copies it.
First, rotate or delete the key in the provider's dashboard. Second, update the new key in every place that used the old one. Third, check the provider's usage logs for calls you did not make. Fourth, find how it leaked, such as a committed file or a front-end bundle, and close that gap.
They are both secrets, but a password is for a person signing in while an API key is for software calling a service. Keys are long and random, usually limited to certain actions, and can be replaced without changing anyone's login.
Only if the provider says that key type is safe to expose. Stripe's publishable keys starting pk_ are meant for front-end code; its secret and restricted keys are not. Anything in the browser can be read by every visitor.
In a secrets vault or your host's environment variable settings. Stripe and Google both say not to put keys in source code or commit them to code repositories.
Revoke or rotate it at once in the provider's dashboard, then put the new key in your server settings. GitHub's guidance on detected secrets is to rotate the affected credential immediately; scrubbing history alone does not make a live key safe.
Use an API key when your own server talks to a service on your own account. Use OAuth when your app must act for other people on their accounts, because each of them then grants and can revoke access themselves.
Related: API key generator, .env file format, Next.js environment variables, Notion API key, Rate limiting explained.
Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.
We.Inc is an AI-powered website builder you can resell under your own brand. Launch a branded client dashboard, bill on Stripe Connect, and deliver AI-generated websites in minutes. White-label plans start at $99 a month for 25 client sites, with a 7-day free trial and no per-site fees.