Learn
What is an API key?
An API key is a long secret string that lets one program use another service's API, its data and actions, on behalf of an account. It works like a password for software: whoever holds the key can do whatever it allows. So keep it secret, give it only the permissions it needs, and switch it off when unused.
Updated
How does an API key work?
An API key works by travelling with every request a program sends to a service. The program adds the key to the request, usually in a header such as Authorization: Bearer <key>; the service looks it up, finds which account it belongs to and what it may do, and either carries out the request or refuses it. Most services also log which key made each request.
Nothing about the key itself proves who is using it. Google's documentation makes the point about its standard keys: a standard API key "doesn't authenticate a principal", meaning it identifies a project rather than a person. The key is a bearer token: whoever bears it gets in.
What does an API key look like?
An API key looks like a long random string, often with a short prefix saying what kind of key it is. Stripe's keys are a clear example of how one service uses several kinds for different jobs:
| Stripe key | Starts with | Safe to expose in a website or app? | What it can do |
|---|---|---|---|
| Publishable key | pk_ | Yes | Identify your account and collect payment details, but not charge or read data |
| Secret key | sk_ | No | Unrestricted access to all of Stripe's APIs |
| Restricted key | rk_ | No | Only the permissions you choose |
| Organisation key | sk_org_ | No | The same as a secret or restricted key, across several Stripe accounts |
Sandbox keys add test to the prefix, such as pk_test_, so test and live keys can't be confused. Stripe now recommends restricted keys over secret keys for new uses, because "you can't limit their permissions" on a secret key.
What's the difference between an API key, a password and OAuth?
They all prove a request is allowed, but they differ in who uses them and how much control you keep.
| Password | API key | OAuth sign-in | |
|---|---|---|---|
| Used by | A person | A program | A program, after a person approves |
| How it's created | You choose it | The service generates it | You click "Allow" on the service's own page |
| Second factor | Often | No | The person's sign-in can have one |
| Scope | Everything the person can do | What the key allows | The permissions shown on the approval screen |
| Expires | When you change it | When you revoke it | Tokens expire and refresh by themselves |
| Best for | Signing in | Your own scripts, servers and developer tools | Connecting apps, such as an AI assistant, to your account |
That's why AI apps increasingly connect by OAuth rather than keys: the Model Context Protocol, the standard most of them use to reach other services, builds its authorisation on OAuth. Keys remain the simple choice for developer tools and your own servers.
How do you keep API keys safe?
Keep API keys safe by treating each one as a password with no second factor. Stripe's advice to its own users makes a good checklist:
- Store keys in a secrets vault or environment variables, never in code or files checked into version control.
- Never send keys by email or chat.
- Use the least permission that does the job: a restricted key rather than a full secret key.
- One key per use, so you can see which program did what and switch off one without breaking the rest.
- Limit where a key works from, such as your known servers, where the service allows it.
- Rotate keys when people who had access leave.
- Delete keys you no longer use.
How do AI agents use API keys?
AI agents use API keys, or OAuth tokens, to act in services on your behalf, so the key decides what the agent can do. An agent connected with a full-access key can do anything your account can; one connected with a narrow key can only do that job. Stripe now lets you tag a restricted key as belonging to an autonomous agent, so agent activity can be told apart from your own code's.
The principle is the same as for a new employee: give the agent its own key, scoped to the work, acting as a specific person, with a record of what it did and a way to switch it off at once.
How do API keys work in Mojobase?
In Mojobase, each person makes their own keys for agents in Settings → Connect an agent. A key is shown once, stored only as a hash, can be switched off at once, and each person can have up to 10. An agent using a key acts as that person, with their role and only the apps they may open, so it sees exactly what their screens show. Every call it makes appears in Activity under the agent's name, with Undo.
Keys suit developer tools such as Claude Code; claude.ai and ChatGPT sign in with your Mojobase account instead, so there's no key to copy. For the AI model itself, Mojobase's AI is included, or a company can use its own AI provider's API key. The Agents page has the steps.
Further reading
Questions people ask
What is an API key used for?
To let software talk to a service without a person signing in each time. A shop's website uses a payment provider's key to take payments, an app uses a mapping service's key to show maps, and an AI agent uses a key to reach your email or calendar through that service's API.
Is an API key the same as a password?
It's similar but not the same. A password lets a person sign in and is usually paired with a second factor. An API key lets a program act directly, with no second factor, which is why it should have narrower permissions than a person's account and be easy to switch off.
Where do I find my API key?
In the service's developer or settings pages, usually under a heading such as API keys, Developers or Connect an agent. Many services show a secret key only once, when you create it, so copy it into a password manager straight away.
What happens if my API key is leaked?
Anyone who finds it can use it until it's switched off, with whatever permissions it has. Revoke it at once in the service's settings, create a new one, update the software that used it, and check the service's logs for activity you don't recognise.
Can I share an API key with a developer or an AI tool?
Better to give each its own key, so you can see who did what and switch one off without breaking the others. Stripe's guidance, for example, is not to share keys over email or chat and to rotate keys when people with access leave.