# API key

Concept · [Technical basics](https://ecosystem.samcarlton.com/technical)

Also called: secret key, credentials, access key

A secret code that identifies your app to another service so that service will answer its [API requests](https://ecosystem.samcarlton.com/model-provider-request). Anyone who gets the key can use the service as you, often at your expense, so it must never be visible to the public.

**For example:** A [founder](https://ecosystem.samcarlton.com/founder) pastes an API key into the [front end](https://ecosystem.samcarlton.com/front-end) of a site. A stranger finds it in the page and runs up charges on the founder's account.

## Connects to (6)

- [API](https://ecosystem.samcarlton.com/terms/api): Application programming interface.
- [Authentication](https://ecosystem.samcarlton.com/authentication): Checking that a person is who they say they are, usually with a login.
- [Back end](https://ecosystem.samcarlton.com/back-end): The part of an app that runs out of sight on a server.
- [Secrets](https://ecosystem.samcarlton.com/secrets): Passwords, API keys and other credentials that software needs to run.
- [Key rotation](https://ecosystem.samcarlton.com/key-rotation): Replacing passwords, API keys and other secrets on a schedule or after a possible leak, so an old stolen key stops working.
- [Google AI Studio](https://ecosystem.samcarlton.com/google-ai-studio): Google's web tool for trying Gemini models, testing prompts and getting an API key to build them into an app.

Map view: https://ecosystem.samcarlton.com/api-key