A credential that identifies a software client and helps control access to an API.
An API key is a value that a client sends with an API request so the API can identify the caller and decide whether to accept the request.
The server checks the key before it provides data or performs an action.
Simple Definition:
An API key is a credential used to identify and control an API caller.
Think of an API key like an access card for a building.
The card tells the entrance system which visitor is arriving.
The system checks the card before opening a door.
A valid card may still open only the doors that its access rules allow.
Analogy:
An API key gives an API a practical way to recognize a client and apply access controls.
Associate a request with an application, project, or integration.
Allow or reject requests based on the key and its rules.
Connect usage quotas and rate limits to a client.
Disable a key without changing the whole API.
API keys are common when a software client needs access to an API without an interactive user login.
One service calls another service.
A developer tool calls a platform API.
An application connects to a provider.
A key may be exposed only when the provider limits its permissions and allowed origins.
GET /v1/weather Host: api.example.com X-API-Key: sk_live_example_key
The client includes the key in a request header. The API checks the key, applies its access rules, and then returns a response or an error.
The example key is fictional. Real keys should be stored securely and rotated when exposure is suspected.
The API key travels with the request; the API gateway or service validates it before access is granted.
Usually identifies a client, project, or integration when it calls an API.
Usually helps a user prove knowledge of a secret during sign-in.
Usually represents granted access for a user or service for a limited time or scope.
An API key is a credential, not proof that every caller or every action is allowed.
| ENGLISH TERM | 中文 | SIMPLE ENGLISH | 中文小白理解 |
|---|---|---|---|
| API Key | API 密钥 | A credential used to identify and control an API caller. | 用来识别 API 调用方并控制访问的一串凭证。 |
| Credential | 凭证 | Information used to prove or represent access. | 用来证明身份或表示访问权限的信息。 |
| Request Header | 请求头 | Metadata sent with an HTTP request. | 随 HTTP 请求一起发送的附加信息。 |
| Authentication | 身份验证 | Checking who or what is making a request. | 检查请求是由谁或什么系统发出的。 |
| Authorization | 授权 | Checking what a caller is allowed to do. | 检查调用方被允许执行哪些操作。 |
| Rate Limit | 速率限制 | A rule that limits requests over a period of time. | 限制一段时间内可以发送多少次请求的规则。 |
| Secret | 机密信息 | Private information that should not be exposed. | 不应该公开或泄露的私密信息。 |
An API key is a credential that helps an API identify a client and enforce access rules.
Keep API keys private, limit what they can access, and rotate or revoke them when needed.
Core Flow:
Client → Request with API Key → Access Check → Response