IT Glossary
What is an API key?
A secret code with which one application identifies itself when using another's services — the password between programs.
A hotel key card opens your room and the gym at permitted hours, and nothing else; reception can deactivate it at any moment. An API key works identically, but between programs. When your application requests data from an external service — a courier, a payment processor, a mapping provider — it presents the key, and the provider then knows who is asking, what they are permitted to do and how much they have consumed. Billing, rate limits and permissions all hang off that key. Why this concerns you directly: API keys are the equivalent of company passwords and a favourite target for attackers, since a leaked payment key means money spent in your name. The hygiene rules are not complicated. Keys never go into the public code of a website, they are held in a secrets manager, they are rotated on a schedule, and each one gets only the minimum permissions it needs. It is entirely reasonable to ask your development team for evidence that all four are true.
Let’s talk about your project
Message us on WhatsApp or send an email — you talk directly to a developer.
office@northdan.com · +40 752 070 247
Why it matters for your business
Granular control over access
Each integration gets its own key with exactly the permissions it needs, so compromising one does not open every door and revocation stays surgical.
Accurate traceability and billing
Consumption is measured per key, so you can see which integration generates cost, which one is being abused, and where the API subscription money goes.
Incidents stopped in one move
On any suspicion of a leak, the key is revoked and reissued within minutes — no company-wide password resets and no downtime for the other integrations.
Frequently asked questions
What is the difference between an API key and an OAuth token?
A key identifies an application and is usually static and long-lived. An OAuth token represents the consent of a specific user, expires quickly and carries fine-grained permissions. Server-to-server integrations use keys; access to customer data uses OAuth.
How does an API key end up leaked on the internet?
Most often through accidental publication in code on GitHub, or inside the site's visible JavaScript. Attackers run scanners for exactly these leaks around the clock and use the keys within minutes, which is why the major providers now scan for their own exposed keys as well.
How often should API keys be rotated?
Sound practice is a fixed interval of three to twelve months depending on sensitivity, immediately when an employee with access leaves, and instantly on any suspicion of compromise. Rotation has to be a rehearsed procedure rather than an emergency improvisation.
Let’s talk about your project
Message us on WhatsApp or send an email — you talk directly to a developer.
office@northdan.com · +40 752 070 247