Definition
A unique identifier used to authenticate and authorize API requests, typically passed as a header or query parameter.
In Depth
API keys identify the calling application (not the user). They should be stored securely (environment variables, secret managers like Doppler), never committed to source code, rotated periodically, and scoped to minimum required permissions.
Example Usage
Storing the OpenAI API key in Doppler and injecting it at runtime, never hardcoding it in source code or committing it to git.
Business Context
API key leaks are one of the most common security incidents — using a secrets manager like Doppler prevents accidental exposure.
Related Terms
Cross-Origin Resource Sharing
A browser security mechanism that controls which domains can make requests to your API, preventing u...
Cross-Site Request Forgery
An attack that tricks authenticated users into performing unintended actions on a web application th...
Encryption at Rest
Protecting stored data by converting it into an unreadable format that can only be decrypted with th...
Multi-Factor Authentication
A security method requiring two or more verification factors (password + phone code, biometric, hard...
OAuth 2.0
Industry-standard protocol for authorization and API access delegation.
Also Known As
Tags
Quick Info
Need help implementing this in your business?
Get Started