What is an API key?
An API key is a secret password an app uses to prove it is allowed to call an API. Anyone who has the key can use your account until you revoke it.
Also called: key rotation
In plain English
It looks like a long random string. Vendors show it once. If you paste it into ChatGPT, email, or a shared doc, treat it as stolen and roll it. A key is not a login you type every morning. It is a badge for software. Store the key where the workflow runs, not where the prompt is written. A key in a chat transcript is a key in the logs. Give the key the smallest job it can do, and write down who is allowed to see the secret store. When someone who had it leaves, replace the key the same day, then click through the workflow once to prove the new one works. A key that can refund, delete, and export is three keys pretending to be one. Split them when the vendor allows separate credentials. Never paste a live key into a support chat, even with the vendor. Seal production credentials away from the laptop you carry to a coffee shop and away from any screen-share.
How an owner would use it
Store keys in the automation tool's connection screen or a password manager. Give each tool its own key. Revoke a key the day someone who had it leaves. Do not put a key in a prompt, a screenshot, or a SOP.
Common mistakes
The classic failure is a key in a Google Doc titled 'how the Zap works,' or in a prompt someone pasted so the model could 'see the format.' Treat that key as public and replace it. Rotating a key means issuing a new one and revoking the old. Do that when a contractor leaves, not once a year on a poster. A key that can do everything is worse than a key that can only read the one resource the job needs.
A worked example
A neighborhood retailer
The key that was in the doc
This is an illustration, not a customer result. A manager pasted a shipping API key into a shared SOP so the closer could 'see how it works.' They deleted the line, revoked the key, and issued a new one that lives only in the automation account.
Related terms
Prompts and guides
Questions owners ask
What is an API key?
An API key is a secret that lets software call an API as you. It should be stored in a connection setting, not in a document or a chat.
How do I use an API key safely?
Create it in the vendor dashboard, paste it only into the tool that needs it, and revoke it when staff or vendors change. Never include it in a prompt.
Is an API key the same as a password?
It is a password for software, not for a person at a login screen. People should still use their own accounts. The key belongs to the automation, stored in that tool's connection screen.
Product guides are on AI apps for business.