API key
API key: A secret string that identifies your program to an online service, so the service lets it in and bills the right account. Anyone holding the key can act as you, which is why it never belongs in code.
Not the same as a password
A password is typed by a person at a login screen. An API key is read by a program and sent with every request, which is why it ends up in files, logs and screenshots where a password never would.
Where it bites
Once a key is committed it lives in the repository’s history: deleting the file in the next commit does not remove it, and once it is pushed anyone with access to the repository can read it. The fix is to revoke the key with the provider and issue a new one.
Covered in these lessons
Where this comes up
Also written as api key, api keys. Checked 2026-10-22.