API Key

You might say

Connect the LLM API for me; read the API Key from environment variables, and never hardcode its value in the source code.

An authentication credential used by applications to prove identity, verify permissions, and track resource usage with an API service.For example, a web app can read an API key from an environment variable and send it with an AI request. The service usually associates permissions and usage with the key's account, project, or application—not necessarily a specific person. A leaked key may spend quota or expose data, so keep it out of source code, repositories, and chat logs, then revoke and replace it immediately if exposed.

Know first

API Env Var

Access KeySecret KeyToken

Same key, right place versus wrong place

Env var on the deploy platformAI_API_KEY = sk-••••3f2k

Code references the name onlyprocess.env.AI_API_KEY

The key is a badge for programs, not a password to memorizeIt usually displays fully once at creation; on leak, revoke first.

What it does

A badge for programs: Your page sends the string with an AI request. The service verifies its account, project, or application, then applies the corresponding permissions and usage tracking.

Created in the provider console: Create the key on the service's website; it usually displays fully only once at creation, so save it right away.

Revoke on leak: If the key shows up somewhere it should not, revoke it in the console and create a new one—faster and safer than investigating who saw it.

You can say this to an AI Agent

Read the API key from an environment variable named AI_API_KEY; never put the real key in code or examples. If you spot a key hardcoded somewhere, tell me so I can revoke and rotate it.

Learn next

1API→2Env Var→3Rate Limit→

Recommended tool

Web fine-tuning tool · Selector Pro

Select page elements for precise AI edits

Click a button, text, or card, note the change, then copy its exact location to AI.

Open Selector Pro website

The AI hardcoded your API Key in the source. What is the right fix?

A. Send it to teammates so everyone pastes it into their codeB. Move it to an environment variable; reference the variable name in codeC. It's a private repo, just leave it

ANS Original Methods

Apply this term in a real workflow

Credentials & Cost

Manage Keys, Quotas, and Fallbacks Before Running Models or Workflows

Keep API keys, environment variables, credit usage, and failure states explicit; never commit secrets to frontend code or public repos.