FundamentalsBeginner
What is an API Key? Authentication, Bearer Tokens, and Security Explained
Direct Answer & Overview
An API key is a unique, secret cryptographic string passed in HTTP headers that identifies the calling application, verifies its permissions, enforces rate limits, and attributes usage billing.
1.How API Key Authentication Works
When you register for an API service, the server generates a cryptographically random token (e.g. `sk-live-94a8e2bc7f...`). On every subsequent request, your client includes this token in the `Authorization` HTTP header as a Bearer token: `Authorization: Bearer sk-live-...`. The server validates the token against its database in sub-millisecond in-memory caches (Redis), confirming your identity before executing the request.
2.API Keys vs. Passwords vs. OAuth Tokens
• Passwords: Used by humans to log into user interfaces; require hashing and session cookies.
• API Keys: Used by programmatic backend servers; persistent, high-entropy tokens designed for automated machine-to-machine calls.
• OAuth Tokens: Ephemeral, short-lived tokens (typically expiring in 1 hour) scoped to specific user permissions on behalf of third-party apps.
3.Critical Security Rules: Never Expose API Keys in Client Code
Never place API keys in client-side React/Next.js components, mobile apps, or public GitHub repositories. Automated scrapers crawl GitHub in seconds and drain compromised API keys. Always store keys in server-side environment variables (`.env.local`) and execute calls from backend route handlers.
Authenticating with Bearer Token in Pythonpython
import os
import requests
# Load key from secure server environment variable
API_KEY = os.environ.get("API100_API_KEY")
headers = {
# Standard Bearer token authentication header
"Authorization": f"Bearer {API_KEY}",
"Content-Type": "application/json"
}
response = requests.get("https://api.apihundred.com/v1/models", headers=headers)
print("Authenticated successfully:", response.status_code == 200)Frequently Asked Questions
What should I do if my API key is leaked publicly?
Immediately revoke and delete the compromised key from your API provider dashboard and generate a new key to prevent unauthorized charges.
Why are API keys called 'Bearer' tokens?
Because whoever 'bears' (holds) the token is granted access, making secret custody paramount.
Can an API key have spending limits?
Yes, advanced gateways like API100 allow setting monthly dollar limits, allowed model whitelists, and rate limits per key.
A100
API100 Engineering Team
Infrastructure & Latency Research