API Key.

Static secret string issued by a service to identify and authenticate a caller, usually sent in a header or query parameter on every API request. It belongs to the Identity & Access category of cybersecurity.

Static secret string issued by a service to identify and authenticate a caller, usually sent in a header or query parameter on every API request.

API keys are long, randomly generated strings that identify a project, service account, or developer to a backend API. They are simple to issue and use but offer weak guarantees: they identify the caller, not the user, do not expire by default, and grant whatever permissions are bound to them. Best practices include storing keys in a secrets manager, never embedding them in client-side code or public repos, scoping each key narrowly, restricting them by IP or referrer, rotating them on a schedule, and revoking immediately when leaked. For end-user authorization or high-value operations, prefer OAuth 2.0, mTLS, or signed requests instead.

Defences for API Key typically combine technical controls and operational practices, as detailed in the full definition above.