API key
An API key is a value an application supplies to an API to identify a project or account, or to authorize requests, depending on how the service implements it.
The name does not tell you its authority
Different services use API keys differently. Google Cloud’s standard API keys associate requests with a project for billing and quota; they do not authenticate a principal. Stripe distinguishes publishable keys, designed for client-side use, from secret keys that can perform sensitive operations. A key found in a browser is therefore not automatically an exposed secret, but a server-side secret placed there needs attention.
Find out what the particular key permits, which environment it belongs to, and what restrictions apply.
API keys, access tokens, and client secrets
An OAuth access token represents authorization to access protected resources. An OAuth client secret is used to authenticate a client to the authorization server. An API key follows the issuing service’s own rules. These values can all look like strings of random characters, but their roles and replacement procedures differ.
If a secret key is exposed, use the provider’s revocation or rotation process and update the integrations that depend on it. Restrict the replacement to the work it actually needs. A user’s password reset is not evidence that a separately issued API key has stopped working.
Stolen integration tokens explains why responders need to identify the credential and its actual reach. Application credential changes covers a related approval problem: whether a request to add new application authority is legitimate in the first place.