Tokencito Game of the day Play

What is an AI API key?

By the Tokencito team · Updated on

An API key is a long password that identifies your account when a program uses an AI model through its API. It tells the provider who is asking and who to bill. That is why anyone who has it spends in your name: keep it secret, like your credit card.

🔑You create the key🔒You keep it on the server📨It goes in every request📋The bill goes to you

Put it to the test

A question from the app. Pick an answer.

The server needs an access key. Where do you keep it?

Start playing on the web

A password that pays

You create it in the provider's dashboard, and it is a long string of letters and numbers. Many providers show it only once, so you copy it right then. Unlike your password, nobody types it: your program sends it by itself with every request to the AI API, in a header.

Every request uses tokens from the model, and every token is billed. If someone copies your key, their requests are billed to your account, and they can make thousands in one night.

A request with the key in the header (fake key)
POST /v1/responses HTTP/1.1
Host: api.example.com
Authorization: Bearer sk-FAKE-1234-this-is-not-a-real-key
Content-Type: application/json

{ "model": "some-model", "input": "Hello" }

Where to keep it, and where not

It goes in an environment variable on your server, or in a .env file that never gets pushed to the repository. The code reads the variable and never has the key written in it.

Never in the code or in a repository: even if you delete it later, it stays in the history, and there are programs that scan public repos looking for keys. Never in the frontend: whatever runs in a web page or a mobile app can be opened and read. The app asks your server, and the server asks the API.

The .env file (kept out of the repo) and the code that reads it
# .env
AI_API_KEY=sk-FAKE-1234-this-is-not-a-real-key

// server.js
const key = process.env.AI_API_KEY;

If it leaks

Revoke it in the provider's dashboard and create a new one; renaming it or deleting it from the repo is not enough. Then put the new one where it belongs and check the usage dashboard in case someone already used it.

To keep a mistake cheap: one key per project (if one leaks, you revoke only that one), a monthly spending limit and an alert before you reach it. And if you work with a coding agent, check that it does not copy the key into a file that gets pushed.