Most modern tools offer an API, a way for software to talk to them directly instead of through their website. An API key is how the tool knows who is calling. When you connect an AI model, an email platform or an analytics tool to your own code or to an automation platform, you are usually asked to create an API key and paste it in.
How Does an API Key Work?
You create the key in the service's dashboard. Your code then sends it with every request, usually in an HTTP header such as Authorization: Bearer followed by the key. The service looks up the key, checks that it is active and allowed to do what is being asked, logs the usage against your account, and returns the result. Usage based services, such as AI model APIs priced per token, bill whatever account the key belongs to.
API Key vs Password vs OAuth
- Password: proves a person is who they say they are when logging in to a website.
- API key: identifies an application or project calling an API. It is simple to use but gives full access to anyone holding it.
- OAuth and service accounts: grant scoped, revocable access on behalf of a user or system, often with short lived tokens. Google Search Console and GA4 use this approach for private data rather than plain API keys.
Where Marketing Teams Use API Keys
- AI models: OpenAI, Anthropic, Google and model hubs like OpenRouter, for content tools and automations.
- Email and CRM: Klaviyo, for example, has a public key that identifies your account in site code and private keys for server side access to your data.
- Automation platforms such as Zapier, Make or n8n, which store your keys to connect apps.
- SEO and analytics tools that offer data through an API.
How to Keep API Keys Safe
- Never put a secret key in website code that runs in the browser. Anyone can view it. Call the API from a server instead.
- Store keys in environment variables, such as a .env.local file that is excluded from Git, and in your hosting platform's secret settings.
- Give each project its own key with the smallest permissions it needs, and set spending limits where the service allows.
- Rotate keys regularly and whenever someone with access leaves.
- Treat any key pasted into a chat, email, document or screenshot as exposed, and replace it.
What to Do If an API Key Leaks
Revoke the key in the service's dashboard immediately, create a new one, and update it everywhere it is used. Then check usage logs and billing for activity you do not recognise. Leaked AI model keys are a common target because attackers can run up large bills on someone else's account, so speed matters more than investigating first.
Frequently asked questions
What is an API key?+
An API key is a secret code that identifies an application when it calls an API, so the service can allow the request, apply the right permissions and bill the right account.
Is an API key the same as a password?+
No. A password identifies a person logging in. An API key identifies an application or project calling an API. Both must be kept secret, but API keys are usually easier to rotate.
Where should I store my API keys?+
In environment variables or a secrets manager, such as a .env.local file excluded from Git and your hosting platform's environment settings. Never in browser code, public repositories or shared documents.
What should I do if my API key is exposed?+
Revoke it right away in the provider's dashboard, create a new key, update it in every app that uses it, and check usage and billing for anything unusual.