API key
An API key is a credential used to identify or authorize a client accessing an application programming interface.
Software Security for Developers
An API key is a credential, usually represented as a secret token, that identifies or authorizes a client calling an application programming interface.
- How it is used
- Authenticates and authorizes service-to-service requests by identifying the calling service with a shared secret.
- How deep it goes
- Explains generation, header transmission, validation, leakage, spoofing, and rotation, but defers detailed lifecycle implementation.
- Examples
- Uses payment processing, billing requests, X-API-KEY headers, and a Java controller that returns HTTP 401 for invalid keys.
- What you can do after
- Apply API keys to simple service calls and recognize when leakage, spoofing, static validity, or scale requires another mechanism.
Read how Software Security for Developers explains API key →
Secure APIs
An API key is a credential string that identifies or authorizes a client when it accesses an API.
- How it is used
- Authenticates nonhuman identities such as applications, services, and devices when they access APIs.
- How deep it goes
- Defines API keys, contrasts them with access tokens, and addresses expiration, rotation, and hardcoded-key risks.
- Examples
- Uses hardcoded keys in connected devices as the concrete failure example, including devices that expose APIs.
- What you can do after
- Operate API credentials by setting expiration, supporting rotation, and recognizing the danger of hardcoded keys.
Spring in Action, Sixth Edition
An access token is a credential that authorizes a client to access protected resources on behalf of a user or other resource owner.
- How it is used
- Authorizes client requests to a protected ingredient API without sending the user’s password on every request.
- How deep it goes
- Works through token issuance, bearer requests, scope checks, JWT verification, and refresh; does not develop every OAuth 2 grant type.
- Examples
- Uses ingredient-API POST and DELETE requests, a token response, curl bearer requests, and a Spring REST client.
- What you can do after
- Apply it via Spring Security to obtain an access token, forward it with API requests, and enforce scoped access.
ASP.NET Core in Action, 3e
An API key is a secret credential used to authenticate an application or request to a remote service.
- How it is used
- Supplies a secret configuration value for outgoing calls to a third-party API.
- How deep it goes
- Defines the key as a secret, then shows storage choices and a handler that attaches it; defers more complex token-based APIs.
- Examples
- Uses a mapping API key stored through User Secrets and an exchange-rate client whose handler adds an `API-KEY` header.
- What you can do after
- Apply it via User Secrets or environment variables and an IHttpClientFactory handler that adds the key to outgoing requests.
Build Python Web Apps with Streamlit
An API key is a secret credential that authenticates software when it accesses an application programming interface.
- How it is used
- Authenticates app requests to external APIs and becomes a secret to configure when the app is deployed.
- How deep it goes
- Walks through obtaining keys, supplying one in a request, and configuring production secrets; does not define a universal key format.
- Examples
- Uses a missing-key error, a TMDB movie-search request, and an OpenAI secret-key creation screen.
- What you can do after
- Operate/configure it: obtain the service’s key, supply it to API requests, and configure Streamlit Community Cloud secrets without sharing the key in code.
Read how Build Python Web Apps with Streamlit explains API key →
Authorization in Action
A shared secret is information known to communicating parties and used as evidence of their association or identity.
- How it is used
- Establishes an API caller’s presented identity or grant at the enforcement boundary before authorization evaluates the request.
- How deep it goes
- Explains credential presentation, token validation, request construction, and policy evaluation, while deferring token-acquisition grant details.
- Examples
- Uses session cookies, a reporting client’s bearer token, and an integration principal restricted to tenant workspaces.
- What you can do after
- Evaluate/understand how a presented API credential is validated and combined with policy for fine-grained access decisions.
Build AI-Enhanced Web Apps
A user-provided API key is an API credential supplied by an individual user for requests made on that user's behalf.
- How it is used
- Secures provider requests while supporting application integrations and user-controlled credentials.
- How deep it goes
- Distinguishes application and user keys, storage models, exposure risks, monitoring, and server intermediaries without implementing a complete credential system.
- Examples
- Uses .env configuration, Next.js server access, OpenAI and Gemini credentials, deployment settings, and provider usage dashboards.
- What you can do after
- Operate/configure API credentials through private environment variables, server routes, encrypted storage, and usage monitoring.
Snowflake Data Engineering
An API key is a credential string supplied to an application programming interface to authenticate or authorize a request.
- How it is used
- Uses an API key to authorize Snowflake pipeline requests to external API endpoints.
- How deep it goes
- Explains authentication, credential generation, secret storage, integration wiring, and privileges, but not key format or rotation.
- Examples
- Demonstrates a private Yelp key stored as YELP_API_TOKEN for the Reviews endpoint.
- What you can do after
- Operate/configure a Snowflake external API call using a secret, network rule, integration, and required privileges.
Django in Action
An API key is a secret token used to identify or authorize a client making API requests.
- How it is used
- Protects API endpoints from unrestricted access, including read and modification operations.
- How deep it goes
- Explains header-based validation and authentication scope, but does not develop broader key-management practices.
- Examples
- Demonstrates an APIKeyHeader subclass using X-API-KEY and settings.NINJA_API_KEY.
- What you can do after
- Operate/configure Django Ninja endpoints with a header-based API-key authentication handler.
Automating API Delivery
An API key is a credential used to identify or authorize a client requesting access to an API.
- How it is used
- Secures API-gateway requests by identifying the application consuming the API.
- How deep it goes
- Explains gateway configuration and request execution, stopping short of key lifecycle management or rotation.
- Examples
- Uses Kong YAML configuration and a curl request containing Host and x-api-key headers.
- What you can do after
- Operate/configure Kong to require an API key and make an authenticated request through the gateway.
.NET MAUI in Action
An API key is a credential that identifies or authorizes a client when it accesses a service API.
- How it is used
- Configures a .NET MAUI app to authenticate requests for movie and genre data.
- How deep it goes
- Shows field declaration and query-string usage in HTTP requests, without detailing broader credential management.
- Examples
- Uses a The Movie Database key in the MauiMovies app to retrieve trending movies and genres.
- What you can do after
- Configure and operate authenticated movie-data requests from a .NET MAUI application.
Amazon Web Services in Action, Third Edition: An in-depth guide to AWS
An AWS access key is a credential consisting of an access key identifier and a secret access key for programmatic authentication.
- How it is used
- Authenticates the AWS CLI as an IAM user for programmatic access to AWS services.
- How deep it goes
- Defines the credential pair, demonstrates CLI configuration and testing, and stops short of credential rotation or storage mechanisms.
- Examples
- Uses aws configure followed by aws ec2 describe-regions to demonstrate credential setup and authentication.
- What you can do after
- Operate the AWS CLI by configuring access keys and verifying authentication with an EC2 regions query.
Read how Amazon Web Services in Action, Third Edition: An in-depth guide to AWS explains API key →
Practical Automation with PowerShell: Effective scripting from the console to the cloud
An API key is a secret token used by an application or script to identify or authorize access to an application programming interface.
- How it is used
- Authenticates PowerShell requests to external APIs and supports unattended automation.
- How deep it goes
- Explains authentication purpose, parameter placement, retrieval, testing, and risks, but defers provider-specific key generation and authentication schemes.
- Examples
- Demonstrates geo.ipify.org geolocation, SendGrid email delivery, and a SQL health-check automation.
- What you can do after
- Apply it via Invoke-RestMethod by supplying a provider-required key and parameters while protecting the secret in automation.
Related concepts
- authorization serverproduced by · An authorization server is an OAuth component that authenticates clients or resource owners, obtains authorization, and issues credentials such as authorization codes and access tokens.
- refresh tokenproduced by · A refresh token is a credential a client presents to an authorization server to obtain a new access token without repeating the user authorization process.
- message authentication codeused by · A message authentication code is a keyed cryptographic value generated from a message to verify its integrity and authenticity.
- configurationkind of · A specification of settings, parameters, or component relationships that determines how a system, application, model, or process is structured or operates.
- OAuthproduced by · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
- authorization code flowproduced by · The authorization code flow is an OAuth protocol in which a client obtains a short-lived authorization code after user authorization and exchanges it for access or other tokens.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.