What Is an API, and Why Your API Key Is a Wallet Key

An API (application programming interface) is the way one program asks another to do something or hand something over. If a user interface is buttons and screens for people, an API is an interface for programs: a list of requests you can send and the responses you will get back.

The question “what is an API?” comes up for anyone who plugs payments, maps, email or an AI model into their app. The idea is simple, but there is one thing worth understanding straight away: an API key is money.

What is an API, in restaurant terms

Think of a restaurant. You do not walk into the kitchen; you tell the waiter what you want from the menu. The waiter passes on the order, the kitchen cooks, the waiter brings the dish. The menu is the API documentation, the waiter is the API, and the kitchen is someone else’s server you will never see.

In practice it looks like this. Your app wants to send an email through a mail service. It sends a request to an address like https://api.mailservice.com/send with the recipient, subject and body. The service replies “accepted, here is the message ID” or “error, invalid address”. Each of those addresses with a specific action is called an endpoint.

Almost everything your app does “out of the box” actually happens through other people’s APIs: payments, sign in with Google, maps, SMS, text generation. And your own backend is an API too, just one built for your frontend.

What an API key is for

A service needs to know who is calling it, so it can bill you, apply limits and tell you apart from everyone else. When you sign up, you get a key: a long string you attach to every request.

Here is the important part. To the service, the key is you. It does not check where the request came from or who actually sent it. If someone gets your AI model key, they generate text on your bill. If they get your email service key, they send spam in your name and your account gets banned. If they get a payment key with refund rights, you can guess the rest.

So treat an API key as a key to your wallet, not as a password to something unimportant. Leaked keys get used quickly: automated scanners comb public repositories and website code for them all the time.

Public vs secret keys

Many services issue two kinds of keys, and mixing them up is dangerous.

• A public key (publishable, anon, client key) is designed for browsers and mobile apps. It only allows what is safe to expose to everyone: starting a checkout, showing a map, querying the database as an anonymous user. It is visible in your site’s code, and that is fine.
• A secret key (secret, service role, server key) grants full access: charging money, reading all data, bypassing access rules. It lives only on the server, in environment variables, and never ends up in the browser, the repository or a screenshot.

A simple rule of thumb: if the name or docs say secret, service_role or private, or the key starts with sk_, it belongs on the server only. If a service gives you a single key for everything, treat it as secret.

Restrict public keys too. Many services let you lock a key to your domain or app, so another site cannot use it.

What to do if a key leaks

1. Revoke it in the service’s dashboard right away and issue a new one. Deleting it from your code is not enough: a copy may already be out there.
2. Check the usage log and the bill for requests you did not make.
3. Set spending limits and alerts wherever the service allows. That will not prevent a leak, but it prevents a disaster.
4. Find out how the key got out and close that route, or the new key will leak the same way.

In short

• An API is how programs ask each other for data and actions.
• An API key tells a service who pays, so whoever holds your key spends your money.
• Public keys can be shown in the browser; secret keys stay on the server.
• A leaked key must be revoked and replaced, not just removed from the code.
• Spending limits on external services are cheap insurance against an expensive mistake.

SUBXCAT can check where the keys in your app live and what they actually allow.