What is an API key?
An API key is a secret string of characters that identifies a piece of software when it connects to another system's API, giving it permission to read or change data on behalf of the account that created the key.
An API key works like a building access card issued to a program instead of a person. Whoever holds it can do whatever that key allows, without a password prompt or a second login step. That convenience is why API keys power so many integrations, and also why a leaked key can expose client records, send messages or run up usage charges before anyone notices.
Sensible handling is straightforward. Create keys from a company-owned account, not an individual's. Give each key the narrowest permissions the integration needs. Store keys in the integration platform or a password manager, never in email, chat or shared documents. Record which key powers which automation, and revoke keys promptly when a vendor relationship ends or the employee who set it up leaves.
Some systems use OAuth connections instead, where you click "allow" and the platform manages tokens behind the scenes. Those carry similar risks and should be reviewed the same way. For firms with regulatory duties, such as tax preparers under IRS Publication 4557 guidance or practices handling health data, key management belongs in the written security plan.
Example
For example, a bookkeeping firm discovers that a former contractor created the API key linking its client portal to its document storage, using a personal email address. The firm creates a new key under its admin account, limits it to the folders the portal needs, updates the integration, and revokes the old key the same afternoon.