API Keys and Authentication

Every request to an AI API must be authenticated. Authentication proves that you're an authorized user and tracks your usage for billing. The standard mechanism is the API key.

What Is an API Key?

An API key is a long, randomly-generated string that uniquely identifies you:

sk-proj-abc123def456ghi789...

When you include this in your request headers, the API knows who you are and can:

Track your token usage
Apply your rate limits
Bill your account

Getting an API Key

1. Create an account at [platform.openai.com](https://platform.openai.com)
2. Navigate to API Keys in the dashboard
3. Click Create new secret key
4. Copy the key immediately — it's only shown once

The Cardinal Rule: Never Hardcode API Keys

# ❌ NEVER DO THIS
client = OpenAI(api_key="sk-proj-abc123...")  # visible in source code

# ✅ ALWAYS DO THIS
import os
client = OpenAI(api_key=os.environ["OPENAI_API_KEY"])

Hardcoded keys in source code get committed to Git, where they're permanent — even if you later delete the line, the key is in the history. Leaked keys cost real money and can be exploited instantly by bots scanning GitHub.

Key Security Best Practices

| Practice | Why |
|---------|-----|
| Store in environment variables or secrets manager | Never in source code |
| Use different keys per environment | Isolate dev, staging, production |
| Set spending limits on the dashboard | Cap the blast radius of a leak |
| Rotate keys regularly | Limit exposure window |
| Revoke old keys immediately | No dormant credentials |

Rate Limits and Quotas

API keys come with rate limits that vary by tier:

RPM (Requests Per Minute) — how many calls you can make per minute
TPM (Tokens Per Minute) — total token throughput per minute
Daily token limit — some tiers have per-day caps

Understanding your rate limits is essential before building high-throughput features.

Key Security Best Practices