Glossary · Security and access
API key
A credential-like string used by an API to associate a request with a project, quota, or permitted capability.
Definition
An API key is supplied with an API request so the provider can identify a project, apply quotas, or permit configured access. Different vendors give keys different security meaning. Keys should be restricted where supported, stored outside public source, rotated when exposed, and granted no more capability than required.
Why it matters
A leaked key can consume quota, expose data, or enable actions depending on the service. The key's actual permissions must be documented rather than assumed.
Common misunderstanding
An API key is not universally the same as a user identity or full authorization. Some keys identify only a project; stronger actions may require OAuth or another credential.
Related terms
Related system family: Secure Integrations & Custom Tools
Sources
- Manage API keys (opens in a new tab) · Google Cloud Documentation
Last reviewed July 16, 2026