API key
Last verified
An API key authenticates requests. Possession is authorisation — there is no second factor, no device binding, and no user identity attached.
Which means a leaked key is immediately usable by anyone who finds it, and providers generally hold the account owner responsible for the resulting charges.
Practices that follow: never in source, one key per service so you can revoke precisely, named at creation, and rotated when people leave. Your OpenAI API key leaked.