What is an API key?
A secret string that identifies and authenticates a client when calling an API, usually passed in a header on each request.
An API key is the simplest form of API authentication: the service issues you a long random string, you include it in every request (typically as Authorization: Bearer sk_live_… or in an X-API-Key header), and the service uses it to identify your account, scope your permissions, and meter your usage.
Keys are easy to generate, rotate, and revoke, which is why they dominate developer-facing APIs. The trade-off versus OAuth is that an API key authenticates the application, not an end user, fine for server-to-server traffic, wrong for any flow where a real user's identity matters.
Keep API keys out of client-side code, public repos, and Slack channels. Use environment variables, secret managers (Vault, Doppler, AWS Secrets Manager), and short-lived keys with scoped permissions. Every leaked-key incident has the same post-mortem.
In the wild
Authorization: Bearer sk_live_abc123…X-API-Key: ctx_abc123…?api_key=…query string (worst option, leaks into logs)