Cybersecurity

API key

a secret code that lets one program use another service

Online services — a payment processor, an email sender, an AI provider — let other programs use them through a secret code called an API key. The program sends the key with each request to prove it is allowed. Anyone holding the key can use that service as the program would: run up its bill, and read the data it returns. That is why a leaked API key is treated like a leaked password, and why a tool that stores many of them is a high-value target.

Think of it as

A keycard for one specific door: whoever is holding it gets in, no questions asked.