An API key is a secret string an application sends with each request so the API can identify the caller and decide what it is allowed to do.
How API keys work
The server issues a long random string. The client sends it with every request, usually in an Authorization header. The server looks it up, finds the account and permissions it belongs to, and allows or refuses the request.
Compared with OAuth, an API key is simpler: no sign-in flow and no refresh step. It is also blunter: anyone who copies it can use it until it is revoked.
Good practice:
- One key per client or agent, never shared.
- The narrowest permissions that work.
- Store keys in a secrets manager or environment variable, never in source code.
- Rotate on a schedule and revoke immediately if exposed.
- On the server, store only a hash of each key, so a database leak does not expose working keys.
An example
A team gives its release bot one key and its research assistant another. When the research assistant's key leaks in a log, they revoke it without touching the release bot.
Why it matters for AI-agent publishing
Each agent's key is its identity. If every agent shares a key, you cannot tell who drafted what or cut one off without cutting off all.
SocialHandoff issues one key per agent, scoped by network and by permission: draft, schedule, analytics. Keys are stored as SHA-256 hashes. Only owner keys can approve, so an agent can never approve its own draft. Set this up in agent keys and permissions.