What Are API Keys and How to Protect Them

Welcome back. In this lesson you’ll learn what API keys are, how they authenticate requests, and practical steps to protect them from misuse.

What is an API key?

An API (Application Programming Interface) is a contract between software components that enables one application to access functionality or data exposed by another. When you publish functionality via an API, other systems call that API to integrate those features. For example, you might publish an endpoint that accepts a shopping list and returns vendors offering the lowest prices; an e-commerce site can call that endpoint to display daily deals. An API key is a secret token issued to a client or developer to:

Identify the calling application.
Authenticate and authorize API requests.
Track and monitor usage for billing and auditing.

If an attacker obtains your API key, they can make requests that will be billed to your account and potentially access sensitive data.

How API keys are used — example (OpenAI + Python)

The example below demonstrates a simple chat completion request using OpenAI’s SDK. API keys authenticate this request so the provider can attribute usage to your account.

from openai import OpenAI

client = OpenAI()
completion = client.chat.completions.create(
    model="gpt-4o",
    messages=[
        {"role": "user", "content": "Write a haiku about ai"}
    ]
)

# Access the assistant message (exact attribute may vary by SDK version)
print(completion.choices[0].message.content)

Do not hard-code your key into source files; instead use secure configuration or secret stores (examples below).

Creating an API key (OpenAI web UI — example flow)

Open your account settings (cogwheel / settings).
Select API Keys from the left-hand menu.
Click Create new secret key.
Give the key a descriptive name (for example, MyTestAPI).
Choose the project and permissions (for example, Default project, minimal permissions), then create the key.

A very important detail: OpenAI only displays the secret key once at creation. If you leave the screen without copying it, you must delete and recreate the key.

Do not share your API key or expose it in client-side/browser code. Anyone with the key can make requests that incur costs on your account.

Best practices to protect API keys

Below are recommended security controls and operational practices to reduce risk.

Practice	Why it matters	Example
Keep keys out of source control	Prevent accidental public leaks (e.g., GitHub)	Use environment variables or a secrets manager
Restrict key scope / permissions	Limit what a compromised key can do	Create keys with read-only or limited scopes
Use separate keys per environment	Isolate development/test from production	`dev-key`, `staging-key`, `prod-key`
Rotate keys regularly	Limits exposure if a key is compromised	Automate rotation every 30–90 days
Enforce network restrictions	Prevent use from unauthorized IPs	Use IP allowlists or VPC restrictions
Monitor and alert on usage	Detect anomalies or unexpected costs quickly	Set spend alerts, rate-limit thresholds
Use a secrets manager	Centralize secure storage and access control	AWS Secrets Manager, Azure Key Vault, Google Secret Manager, HashiCorp Vault

Example: store an API key in an environment variable and use it in Python

Unix / macOS (bash/zsh):

export OPENAI_API_KEY="sk-REDACTED"

Python usage:

import os
from openai import OpenAI

api_key = os.environ.get("OPENAI_API_KEY")
client = OpenAI(api_key=api_key)

response = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": "Write a haiku about ai"}]
)

print(response.choices[0].message.content)

For CI systems and production, prefer a secrets manager integrated into your build/deployment pipeline rather than environment variables if supported by your platform.

Additional operational tips

Use your provider’s dashboard (for example, the OpenAI usage dashboard) to review usage, set spending limits, and configure alerts: https://platform.openai.com/account/usage
When demoing publicly or in sample code, use restricted test keys or mocked endpoints to avoid exposing real credentials.
Limit request rates and set quotas where your API provider supports them.
Revoke any key immediately if you suspect it has been leaked or abused.

Store API keys in secure secret stores or environment variables and restrict them to server-side use. Regularly rotate and monitor keys to reduce the risk of unauthorized usage and unexpected charges.

Summary

API keys are simple but powerful credentials that authenticate and identify callers to your APIs. Treat them like passwords:

Generate keys in a secure workflow.
Store keys server-side or in managed secret stores.
Grant minimal permissions and rotate keys regularly.
Monitor usage and enforce limits or network restrictions.

References and further reading

OpenAI API docs: https://platform.openai.com/docs/introduction
AWS Secrets Manager: https://aws.amazon.com/secrets-manager/
Azure Key Vault: https://azure.microsoft.com/en-us/services/key-vault/
Google Secret Manager: https://cloud.google.com/secret-manager
HashiCorp Vault: https://www.vaultproject.io/

Pre-Requisites

Introduction to AI

Text Generation

Features

Vision

What Are API Keys and How to Protect Them

What is an API key?

How API keys are used — example (OpenAI + Python)

Creating an API key (OpenAI web UI — example flow)

Best practices to protect API keys

Example: store an API key in an environment variable and use it in Python

Additional operational tips

Summary

Watch Video

​What is an API key?

​How API keys are used — example (OpenAI + Python)

​Creating an API key (OpenAI web UI — example flow)

​Best practices to protect API keys

​Example: store an API key in an environment variable and use it in Python

​Additional operational tips

​Summary

Watch Video

What is an API key?

How API keys are used — example (OpenAI + Python)

Creating an API key (OpenAI web UI — example flow)

Best practices to protect API keys

Example: store an API key in an environment variable and use it in Python

Additional operational tips

Summary