What are AI API keys?

What it is

When software calls an AI service through its API, the service needs to know whose account to charge. The key is how it knows. It works like a password for a program. It is not tied to a person's face or phone, so no second sign-in step protects it. Anyone who has the text of the key can use it from anywhere until it is cancelled.

Keys leak in ordinary ways. Someone pastes one into a chat or a support ticket, saves it in a shared document, or commits it to code in Git, where the history keeps it even after it is deleted. Automated scanners look for exposed keys, so a leaked key can be misused quickly.

Why it matters to a business

• Charges: the service bills the account for every request, so a stolen key runs up charges until it is cancelled.
• Data exposure: on some services a key also reaches files and other data stored on the account.
• Staff changes: a key that a departed employee knew is still a working key until someone replaces it.
• Shared keys hide problems: if every tool uses one key, you cannot tell which one caused a spike or a leak.

How this shows up in our work

We store API keys in a password manager, never in chats or code. Each application gets its own key, so a problem can be traced and the key cancelled alone. We set spending limits where the provider allows them, and we rotate keys when staff leave. We handle keys this way in our AI and automation work and apply the same access rules in managed IT. See also agentic AI, where tools act with these keys.

Learn more

• API key on WikipediaA neutral explanation of what API keys are and where they fall short as security.
• OpenAI API documentationOne provider's instructions, for the person who will create the keys.
• Claude documentationAnother provider's developer reference, for comparing how keys are managed.