API Key

What is an API key?

An API key is a static secret string that identifies the application, project or integration calling an API, so the provider can authenticate the request, apply quotas and bill usage. It authenticates the caller, not a person: whoever holds the key can use it, from any machine. An API key usually stays valid until someone revokes it, often with the full rights of the account that created it.

Key takeaways

• An API key identifies a calling application or project, not a person, so anyone who copies the key gets exactly the same access.
• An API key usually stays valid until it is revoked, which turns a key pasted into a repository or a ticket into a lasting exposure.
• An API key created by an employee often keeps working after that employee leaves, because many applications attach keys to the workspace, not the user.
• Offboarding has to list and revoke the API keys a leaver created, since disabling the account in the identity provider does not touch them.

How an API key works

• Creation: a user or an admin generates the key in the application's settings or developer console, sometimes with a scope or an expiry date.
• Storage: the key is copied into a script, a configuration file, an integration tool or a secrets manager, which is usually where it leaves its creator's control.
• Use: each request carries the key in a header or a query parameter, and the API checks it against its active keys.
• Rights: the key inherits the permissions it was given, often all the rights of the account or project that created it.
• Revocation: the key stops working only when someone deletes or rotates it, or when its expiry date passes.

API key vs OAuth access token: where does the difference matter?

• API key: created once by a person, tied to an application or a project, valid until revoked, often with broad rights. Nothing in the key says who it acts for.
• OAuth access token: issued by an authorization server after a user or an admin approves specific scopes, short-lived, and renewed by the OAuth flow, not copied by hand.

For governance, the difference is traceability. An access token goes back to an authorization someone granted, which the authorization server can withdraw. An API key goes back only to the memory of whoever created it. Hence the rule: every key in a secrets manager, with a named owner and a rotation date.

Examples and use cases

A 180-person e-commerce company lets its marketing operations lead connect the email platform, the CRM and the analytics tool with API keys generated from her own account. The keys sit in an automation tool and in two scripts on a shared drive. When she leaves, IT disables her Google Workspace account and removes her from the SaaS applications it knows about. The keys keep running: in two of the three tools they belong to the workspace, not to her user, and nobody else knows where they are stored.

Corma's inventory shows the SaaS applications and accounts each employee holds, and its offboarding workflows remove accounts and access across those apps, including apps without SCIM. That list tells IT where keys created by the leaver may live, so they are revoked or rotated in each application, not only in the identity provider.

Related concepts

• Secrets management
• Service account
• Non-human identity (NHI)
• OAuth 2.0
• IT offboarding
• Corma identity and access management platform

FAQ

Is an API key the same as a password?

No. A password proves a person's identity, usually with a second factor. An API key identifies an application, has no second factor and works for anyone who copies it.

Do API keys expire?

Only if the application or the person who created the key sets an expiry date. Many keys stay valid until someone deletes or rotates them by hand.

What happens to API keys when an employee leaves?

It depends on the application. Some apps disable the keys of a deleted user, others attach keys to the workspace and keep them active, so each key has to be checked and revoked in the app.

Where should API keys be stored?

In a secrets manager or the secret store of the deployment platform, never in source code, tickets or chat messages.

Request a demo