API Keys

Definition

A long, randomly generated alphanumeric string provided by an API service to uniquely identify the client making the request, primarily used for tracking usage and rate limiting.

Explain Like I'm New

It's like a VIP pass at an amusement park. Instead of logging in with a username and password, Google Maps just gives you a long random string of text. You attach that string to every request you make. Google checks the string, says 'Oh, this is John's app', and adds 1 to your billing meter.

Real World Example

Integrating Stripe payments. Stripe gives you a Secret Key (`sk_live_123abc`). Your backend sends that key in the header of every request so Stripe knows to deposit the money into your specific bank account.

Common Use Cases

•Server-to-Server communication
•Rate limiting
•Monetization billing

Interactive Example

Console output will appear here...

Interview Questions

basic

Are API keys usually meant to identify a specific human user, or a specific application/project?

intermediate

If you are building a React frontend, is it safe to put a Stripe Secret API Key in your client-side JavaScript code?

Flash Cards

Question

Human or App?

Click to reveal answer

Answer

A specific Application/Project. API keys track machine-to-machine communication. (To identify humans, you use Sessions or JWTs).

Question

Safe in React?

Click to reveal answer

Answer

Absolutely NOT. Any code shipped to the browser can be inspected by anyone. A malicious user will steal your Secret Key, use it to process fake refunds, and drain your bank account. Secret API keys MUST stay on the backend server.