Authenticate software with an application programming interface (API) key.
An API key is a shared secret that identifies a calling application or project. Send it only over Hypertext Transfer Protocol Secure (HTTPS), keep it out of addresses and logs, and limit what it can access.
Why this lesson?
A nightly automation job reads service metrics. The API needs to identify the calling application without an interactive user sign-in.
Learning goal and prerequisites
Provision a restricted key
The developer portal creates a high-entropy secret and associates it with one application, environment, and a limited permission set. The full secret is shown only when it is created.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
Software sometimes needs to call an application programming interface (API) when no person is signing in. A provider may also need to know which application, project, or customer is making requests so it can apply quotas, permissions, and billing. An API key is a simple way to identify that calling software.
An API key is usually a high-entropy secret issued to one application or project. The client sends the key with each request, and the API looks up the server-side record connected to it. Because possession of the key is usually enough to use it, the key must be protected carefully. It should travel only over Hypertext Transfer Protocol Secure (HTTPS), stay out of browser addresses and logs, and be stored outside public source code.
API keys are useful when the system needs simple application identification and the permission model is small. They are less useful when the system needs to represent a signed-in user, short lifetimes, different audiences, delegated consent, or strong proof that a particular workload made the request.
An API key is therefore not automatically a complete authorization system. The API should still limit what the key can do, support rotation or revocation, and record its use. More complex systems may use OAuth or workload identity when they need richer and more temporary credentials.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.