API Key

Overview

An API key is a value presented with a request to identify a calling application, authorize limited access, or apply usage policy. An API Key is commonly a bearer value identifying or authenticating a calling application; it should not be assumed to represent a human user or granular authorization. Embedding keys in browser code, mobile packages, repositories, URLs, or logs exposes them to copying and unauthorized use. Access and retention should protect secrets and regulated information. Changes to API Key should preserve overlap or recovery where required while preventing old credentials from remaining active indefinitely.

Secure use of API Key keeps secrets outside client code and logs, applies least privilege, prevents replay where needed, monitors anomalies, and separates authentication from authorization. A key is usually a bearer secret and does not prove the identity of a human user or protect request content. High-risk operations may require stronger workload identity, signed requests, mutual TLS, or delegated user authorization in addition to a key. The API Key boundary should identify the principal, credential or key, permitted audience, scope, lifetime, and revocation path.

An audit trail for API Key should link the contract and client version, principal, request identifier, sanitized payload evidence, response, callbacks, retries, overrides, provider references, and final state. Keys are commonly sent in a header and can support metering and basic application authentication, although their exact security meaning differs by platform. Status lookup and reconciliation should precede replay, with manual approval for ambiguous or high-value cases. Runbooks must identify who can retry, cancel, replay, rotate, reconcile, communicate, and approve an exception.