An API key is the secret credential software uses to prove it’s allowed to use an API. The API is the counter; the key is the login that gets you served there. Keys carry permissions: some can only read, some can create, edit, or delete, and some are broad enough to do real damage if they leak. Store them in an environment variable or a secrets manager, never pasted into the code.
Consider adding someone to your project software. You don’t hand them the whole company. You give them a login with the right permissions. An API key is that login for software. When every tool shares one powerful key, a single weak spot becomes a company-wide problem.
Why you care
Authentication decides whether a tool can read the report or change production data. Give an agent the smallest key that can do the job, keep keys out of chats, docs, screenshots, and emails, and rotate (swap out for a fresh one) any key you think has been exposed. A key is a badge, and badges should only open the doors the work requires.