An API key is a secret token that identifies who is calling an API and what they are allowed to do. The server checks the key on every request and rejects calls that are missing one or carry a revoked one.
// 01
Why it matters
Keys are the simplest way to authenticate machine-to-machine traffic. Because each key maps to an account, providers can meter usage, apply rate limits, and revoke access without a password reset. A social media API uses the same pattern: an organization key authorizes every publishing request your backend sends.
// 02
Keeping keys safe
Treat an API key like a password: store it in an environment variable or a secrets manager, never commit it to a repository, and rotate it if it may have leaked. Client-side code should never contain a key that authorizes writes.
Go from the definition to the docs that show how to apply it.
Primary solution Quick Start