What is an API Key? Authentication, Bearer Tokens, and Security Explained

Overview #

An API key is a unique, secret cryptographic string passed in HTTP headers that identifies the calling application, verifies its permissions, enforces rate limits, and attributes usage billing.

How API Key Authentication Works #

When you register for an API service, the server generates a cryptographically random token (e.g. sk-live-94a8e2bc7f...). On every subsequent request, your client includes this token in the Authorization HTTP header as a Bearer token: Authorization: Bearer sk-live-.... The server validates the token against its database in sub-millisecond in-memory caches (Redis), confirming your identity before executing the request.

API Keys vs. Passwords vs. OAuth Tokens #

• Passwords: Used by humans to log into user interfaces; require hashing and session cookies.
• API Keys: Used by programmatic backend servers; persistent, high-entropy tokens designed for automated machine-to-machine calls.
• OAuth Tokens: Ephemeral, short-lived tokens (typically expiring in 1 hour) scoped to specific user permissions on behalf of third-party apps.

Critical Security Rules: Never Expose API Keys in Client Code #

Never place API keys in client-side React/Next.js components, mobile apps, or public GitHub repositories. Automated scrapers crawl GitHub in seconds and drain compromised API keys. Always store keys in server-side environment variables (.env.local) and execute calls from backend route handlers.

Code Example: Authenticating with Bearer Token in Python #

import os
import requests

# Load key from secure server environment variable
API_KEY = os.environ.get("API100_API_KEY")

headers = {
    # Standard Bearer token authentication header
    "Authorization": f"Bearer {API_KEY}",
    "Content-Type": "application/json"
}

response = requests.get("https://api.apihundred.com/v1/models", headers=headers)
print("Authenticated successfully:", response.status_code == 200)

Frequently Asked Questions #

Q: What should I do if my API key is leaked publicly?

Immediately revoke and delete the compromised key from your API provider dashboard and generate a new key to prevent unauthorized charges.

Q: Why are API keys called 'Bearer' tokens?

Because whoever 'bears' (holds) the token is granted access, making secret custody paramount.

Q: Can an API key have spending limits?

Yes, advanced gateways like API100 allow setting monthly dollar limits, allowed model whitelists, and rate limits per key.