An API key is a secret string of letters and numbers that a program uses to prove who it is when it connects to a service, such as an AI model provider. Think of it as a door key for software. The service does not check who is holding the key. It only checks that the key fits. If a staff member enters your organization’s key into a writing tool, that tool can use the AI service as your organization.
Why it matters
Anyone who gets a copy of your key can use the service in your name. That often means charges on your account. Sometimes it also means access to your data. Keys leak in ordinary ways. Someone pastes one into a shared document, saves it in a code repository, or types it into a prompt or a system prompt. Keep keys in one private place and give them only to people who need them. If a key may have leaked, revoke it and replace it with a new one right away. Then handle the leak as an AI incident. When you choose a vendor, ask how you can see which keys exist and how fast you can switch one off.
Published Updated