Term · Data, privacy & security
API key
An API key gives an integration access to a system. Handle it as carefully as a password.
In short
An API key (API-sleutel) is a long secret code with which software identifies itself to the API of another system. Whoever has the key gets the permissions that come with it. So store it as carefully as a password, and revoke it when you no longer use it.
What is an API key?
An API key is a secret code, usually a long string of letters and numbers, that gives a program access to the API of a system. In Dutch it is called an API-sleutel. Some packages call it a token.
You can compare it to the key to a building: whoever has it gets in. The system usually does not see who is using the key.
How does an API key work?
You create the key in the system the integration needs to access, usually in the settings. There you often also choose which permissions come with it, for example read-only. The integration sends the key with every request. Is the key correct? Then the integration gets an answer.
The difference with OAuth: with OAuth you log in yourself and the app gets a token that expires after a while. An API key often stays valid until you revoke it.
Example in an SME
Example
Suppose you have an API integration built between your planning and your invoicing. In the planning software you create a key that may only read hours. That key goes into the integration, not into an email. Does the integration stop, or does the person who managed it leave? Then you revoke the key and create a new one if needed.
How do you handle an API key safely?
- Do not share it via email, chat or a shared document. Whoever sees the text has the key.
- Give each integration its own key. Then you can revoke one without shutting down the rest.
- Only give the permissions that are needed.
- Do not put a key in the source code of software, but in a separate, protected place.
- Revoke keys you no longer use, and replace the others with a new one from time to time.
- Do you think a key has leaked? Then revoke it immediately. Could someone see personal data with it? Then it may be a data breach.
Are you having an integration built? Read how I approach integrations and automation.
Frequently asked questions
Is an API key the same as a password?
It is similar: both give access. But an API key is meant for software, not for a person. And you can often give it limited permissions.
What do I do if an API key has leaked?
Revoke it straight away, in the system where you created it. Create a new key and put it in the integration. Then check whether anything has happened to your data.
Sources: Google Cloud: Best practices for managing API keys and OWASP: Secrets Management Cheat Sheet. Consulted on 7 October 2026.
Written by Bart van Engelenhoven Founder of Uniekaiconsultancy in Ede, the Netherlands. Bart analyses how SMEs work and builds software, integrations and AI applications himself. Last updated: 12 October 2026
Read more
Term
OAuth
OAuth lets an app or integration access your data in another system, without you sharing your password. How it works, and what to look out for.
Read moreTerm
API
What is an API? The fixed entrance to a software package through which other software retrieves and sends data. Explanation with an example.
Read moreTerm
Data breach (datalek)
A data breach is unintended access to personal data, or its loss. What do you do then, and when do you report it to the Dutch Data Protection Authority?
Read moreNext step
Curious what could work for you?
- The first conversation is free and without obligation
- By phone or at your premises
- You speak directly with me
Bart van Engelenhoven You tell me what takes up your time, I tell you honestly whether I can help.