What is an API key, and how do you keep it safe?
An API key is a secret string of characters that identifies and authenticates your account when software talks to another service programmatically, functioning like a password for machines rather than people. Keeping one safe means storing it encrypted, never sharing it in chats or documents, setting spend limits at the provider, and rotating it if it may have leaked.
- An API key proves to a service that a request is genuinely coming from your account, the same way a password proves who you are.
- Anyone who has your key can use your account and run up charges on it, exactly as if they had your password.
- Never paste a live key into a chat message, a shared document, a screenshot, or a public code repository.
- Set a spend or usage limit directly at the provider so a leaked key cannot cause unlimited damage.
- Rotate a key immediately if you suspect it has leaked, and periodically even if you don't.
The definition
An API key is a unique, secret string a service issues you when you sign up for programmatic access, to OpenAI, Anthropic, Google Gemini, a telephony provider, a payment gateway, or any similar system. When your software includes that key with a request, the service knows which account to bill, and treats the request as coming from you.
It plays the same role a password plays for a person logging into a website, except a key is meant for software to use automatically, on your behalf, without a human typing it in each time.
Most keys look like a long, random string of letters and numbers, sometimes prefixed to indicate which service or environment they belong to. That randomness is intentional: a key needs to be effectively impossible to guess, since unlike a login form, most API requests do not add extra protections like a CAPTCHA or a lockout after failed attempts.
Why a leaked key is a real financial risk
Because a key authenticates and authorises usage, anyone who obtains yours can make requests that are billed to your account, generating AI responses, sending messages, placing calls, exactly as if they were you, until you notice and revoke it. Unlike a stolen password protecting a single login, a leaked API key connected to a pay-as-you-go AI or telephony service can generate a meaningful bill within hours if it goes unnoticed.
This is why treating an API key with the same seriousness as a banking password, rather than a minor technical detail, matters even for a small business running one AI agent.
The risk is not purely financial either. Depending on what the key unlocks, a leaked credential can let someone read conversation history, send messages as your business, or access customer data connected to that account. The blast radius depends entirely on what permissions the key carries, which is another reason to know exactly what each key you hold can actually do.
Good practice vs risky practice
| Good practice | Risky practice |
|---|---|
| Paste the key once into an encrypted platform setting | Paste the key into a WhatsApp message or email to a colleague |
| Set a monthly spend cap at the provider's dashboard | Leave usage uncapped and unmonitored |
| Rotate the key when an employee with access leaves | Keep using the same key indefinitely regardless of staff changes |
| Store screenshots and setup docs without the key visible | Include the key in a screenshot shared for support |
Rotation and where keys should never appear
Rotating a key means generating a new one and retiring the old one. Most providers let you do this in a couple of clicks. Rotate immediately if you suspect a key has been exposed, and consider rotating periodically as routine hygiene, especially after any change in who on your team has access to it.
A key should never be pasted into a chat app, an email thread, a shared spreadsheet, a support ticket screenshot, or committed into any code repository, public or private. If you need to share credentials with a teammate for setup, do it through the platform's own encrypted storage rather than a message that stays visible in a chat history indefinitely.
Screenshot-sharing during a support conversation is one of the easiest ways this rule gets broken by accident: a settings panel captured to illustrate a problem can include a key in plain view, forwarded to a support channel where it then sits indefinitely, long after the original issue is resolved.
Setting spend limits at the provider
Every major AI and telephony provider lets you set a usage or spend cap directly on their own dashboard, independent of whatever platform you connect the key to. This is the single most effective backstop against a leaked or misused key: even if someone else obtains it, the damage is bounded by whatever limit you set, rather than open-ended. Setting this cap takes a few minutes and is worth doing the same day you generate any new key, not as an afterthought.
Many providers also let you set alerts well before the hard cap is reached. A notification at, say, half of your usual monthly usage arriving unusually early in the billing cycle is often the first real sign that something is wrong, well before the bill itself would have flagged it.
How Convo360 handles this
Convo360 is built BYOK: you connect your own OpenAI, Anthropic, Google Gemini, WhatsApp, voice provider and telephony keys once, and they are encrypted at rest, never shown again in plain text after saving. Provider health monitoring watches for errors from a connected provider, such as an expired or revoked key, and shows a clear alert on your dashboard rather than letting a broken connection fail silently. Staff access to a workspace is controlled through roles (owner, admin, support, finance, analyst), so key access can be limited to the people who actually need it, and revoked cleanly when someone leaves. Because keys are connected once at the workspace level rather than pasted into individual flows or agents, a single rotation at the source updates every agent and flow that relies on it, without needing to hunt down and replace the old value in multiple places.
Example conversation
Connect your keys securely
Start free in minutes — no code, no credit card. Bring your own AI keys and pay no per-message markup.
Frequently asked questions
Is an API key the same as a password?
They serve a similar purpose — authenticating a request — but a key is meant for software to use automatically, while a password is typically typed by a person. Both should be kept equally secret.
How often should I rotate my API keys?
Immediately if you suspect a leak, and otherwise periodically as routine hygiene — many businesses rotate keys whenever a staff member with access to them leaves, or every few months as a general practice.
Can I set a limit so a leaked key doesn't run up a huge bill?
Yes, nearly every AI, telephony and payment provider lets you set a monthly spend or usage cap directly on their own dashboard, which is the most effective safeguard against a leaked key causing serious damage.
Is it safe to store an API key in a shared team document?
No. A shared document is easy to lose track of and often stays accessible to people who no longer need it. Store keys only in a platform's own encrypted credential storage, not in general-purpose documents.
What should I do if I accidentally paste my API key somewhere public?
Revoke or rotate the key at the provider immediately, generate a replacement, and update every place that used the old one. Also check your recent usage for anything unexpected.
Related reading
Available across India — see WhatsApp & AI calling automation by state and city.