An API key is a secret string that identifies and authenticates your application when it calls another service, like OpenAI, Stripe, or a database. Whoever holds the key can act as your application, which is why a leaked key is dangerous: it can run up charges, read data, or take actions in your name until it is revoked.
Public keys vs secret keys
Some keys are meant to be public, like a Supabase anon key or a Stripe publishable key, and are safe in client code as long as the service enforces its own permissions. Secret keys, like a Stripe secret key or a service_role key, grant real power and must only ever live on the server.
How to store a key safely
Keep secret keys in an environment variable, never hardcoded in source, and make sure the .env file is gitignored. Use them only in server-side code so they never ship to the browser. If a key is ever exposed, rotate it, because removing it from code does not undo the exposure.
What this means for AI-generated code
AI coding tools frequently hardcode API keys inline because it is the shortest path to working code. A committed key is scraped from public repos within minutes, so the fix is to keep keys in environment variables and put a secret scanner in front of your commits.