What an API key is and how to keep it secret

An API key is a long, secret code that tells a service who is asking. If someone else gets yours, they can ask as you.

What a key is

¹ OpenAI's help page says "An API key is a unique code that identifies your requests to the API." Most AI makers and business apps work like this. You sign up, create a key in a settings page, and your software sends it with each request.

Think of a staff swipe card. It doesn't say what you look like. It says you're allowed in, and the door logs who used it.

Why a leaked key is a problem

A key works for whoever holds it. The service can't tell your software from a stranger's if both send the same code.

¹ OpenAI warns that a compromised key "can result in data loss, unexpected charges" and more. A stranger could run up your bill, or use up your allowance so your own tools stop working.

Habits that keep a key safe

The maker's own safety page lists them. These are the main ones.

• One key per person.¹ "OpenAI does not support the sharing of API keys." Invite colleagues to the account so each gets their own.
• Keep it out of browsers and phone apps.¹ Putting a key there "allows malicious users to take that key and make requests on your behalf". OpenAI says this "may lead to unexpected charges or compromise of certain account data". Requests should go through your own server.
• Keep it out of your code.¹ "Committing an API key to source code is a common vector for credential compromise." Developers store it in a setting outside the code instead.
• Give keys an end date and swap them regularly. The same page recommends creating new keys before old ones expire.
• Set spend limits.¹ The page warns that "Spend alerts alone don't stop API traffic", so an alert email won't stop a thief on its own. The page also says hard enforcement "can block legitimate requests" and spend "may slightly exceed the limit". Spend limits are covered further in how limits and billing work.

You may not write code at all. Then the same ideas still apply. Don't email a key, don't put it in a shared document, and don't leave it in a chat message.

Keys and AI prompts

Don't type keys, passwords or customer data into an AI chat or prompt. Do otherwise only if your business's own policy allows it, and ask whoever sets the policy if you're unsure.

What to do if one leaks

¹ OpenAI's advice is direct: "rotate your key immediately" if you think it has leaked. Rotating means making a new key and switching off the old one. Then update every app that used the old key, and look at your usage page for requests you didn't make.

When a key stops working

A refused request is often a key problem.² OpenAI lists a revoked key as one cause. Another is that "Your API key contains a typo or an extra space."

³ Anthropic names a malformed, revoked or expired key. The matching status code is explained on the page about reading error codes. For where keys fit in a message, see requests and responses.