Glossary
API Key
An API key is a static secret string issued to a caller and presented with each request to prove the caller is authorized. It's simple to implement on both sides, which is why it remains common, but it carries most of the weaknesses of any long-lived bearer credential: whoever holds the string can use it, it's often logged or embedded in code where it can leak, and it typically has no built-in expiry or scoping beyond however granular the issuing system chose to make it.
More modern token schemes address these gaps directly — short lifetimes, explicit scope, proof-of-possession rather than bare bearer semantics — at the cost of more implementation complexity than pasting a static key into a request header. API keys remain a reasonable choice for low-stakes, low-risk integrations; they're a poor one for anything where a leaked credential would be seriously consequential.