API Key

You might say

Hook up the AI feature. I'll keep the API key in an environment variable—never hardcode the value.

An API key is a password-like string (often sk-…) that lets your program prove "this call is yours" when calling a service, with usage billed to your account.To add AI abilities to a page, create an API key in the provider's console, configure it into your project, and every program call carries the string so the service knows who is calling and whom to bill. It splits the job with your account password: passwords sign humans into pages, API keys authenticate program calls. A leaked key spends your quota—keep it in environment variables, never in code, and revoke it the moment it leaks.

Know first

API Env Var

Same key, right place versus wrong place

Env var on the deploy platformAI_API_KEY = sk-••••3f2k

Code references the name onlyprocess.env.AI_API_KEY

The key is a badge for programs, not a password to memorizeIt usually displays fully once at creation; on leak, revoke first.

What it does

A badge for programs: Your page calls an AI service with the string attached; the service recognizes you, processes the request, and bills your account.

Created in the provider console: Create the key on the service's website; it usually displays fully only once at creation, so save it right away.

Revoke on leak: If the key shows up somewhere it should not, revoke it in the console and create a new one—faster and safer than investigating who saw it.

Quick checkChoose the best answer

The AI hardcoded your API Key in the source. What is the right fix?

Move it to an environment variable; reference the variable name in codeIt's a private repo, just leave itSend it to teammates so everyone pastes it into their code

You can say this to an AI Agent

Read the API key from an environment variable named AI_API_KEY; never put the real key in code or examples. If you spot a key hardcoded somewhere, tell me so I can revoke and rotate it.

Learn next

1API→2Env Var→3Rate Limit→