Suppose your app needs a daily joke or movie information from another service. An API key is a secret credential the app supplies when it makes an API request. Without the required key, a service may reject the request with an error such as “Missing API Key.” section 5.3.1 section 11.1.1
Getting a key into a working app involves three separate decisions:
- Obtain the right credential from the service. For example, create an OpenAI secret key in API Keys, or register for a TMDB API Key rather than its API Read Access Token. section 9.2.2 section 11.1.1
- Send it where that API expects it. A key may go in an HTTP header; the TMDB search example sends it as an api_key request parameter. section 5.3.1 section 11.1.1
- Keep it out of shared code. For a deployed Streamlit app, enter the development secrets.toml contents in Community Cloud’s App Settings → Secrets, then save. section 1.3.6 section 5.4.3
Search for a movie
In a Python shell, a TMDB search uses requests.get with params containing both api_key and query. Replace the example key placeholder with your own key when testing. The response’s JSON contains a results list with movie information; do not share code containing the real key. section 11.1.1 section 1.3.6
Other services use related credentials for different jobs. A GitHub personal access token authenticates repository access, while an AWS access key pairs an ID with a secret for programmatic account access. Use the credential required by the service you are contacting. section 5.2.1 section 12.3.4
