An API key is a secret code that lets software authenticate to a service's API. A program sends the key with its requests, and the service uses it to identify the caller and decide what they may do. Keys are widely used for connecting applications, automating tasks and integrating services.
An API key often acts like a password for a program, and anyone who holds it can act with the permissions of the key's owner. If a key leaks, for example through a public code repository, a log file or a breach, an attacker may be able to read data or perform actions until it is revoked.
How much damage a leaked key can cause depends on its permissions, what it is tied to and whether the service limits where it can be used. Some keys can be restricted to particular IP addresses, services or actions, while others grant broad access. Finding a key in a leaked dataset does not show it was used, but it should be treated as compromised.
If a key may have been exposed, revoke it and create a new one, check the service's logs for activity you do not recognize, and update every application that used it. Use keys with the least permissions needed, keep them out of source code, store them in a secrets manager and rotate them regularly.