Term
API key
A string an application uses to authenticate an API call instead of a human login. It belongs in a password manager, carries only the rights it needs and is revoked when a supplier leaves.
Updated
What it means
An API key is the string one application presents to another when it calls an API. It stands in for a human login, so it deserves the same protection as a banking password.
A key says who is calling, not what they may do. Permissions are set separately: a key that reads exchange rates is of no interest, a billing key with write rights is the whole customer database.
An API key differs from both a password and a short-lived token. A password belongs to a person and is usually guarded by two-factor authentication; a key is presented on its own and often stays valid until someone revokes it. Newer integrations therefore use short-lived tokens that renew automatically and stop working after a while if stolen.
How it works in practice
In an accounting firm, keys connect the software to the bank, the e-shop, invoicing or the carrier’s webhooks. They belong in a password manager or environment variables, not in e-mail or a repository.
The minimum is a separate key per integration, only the rights needed, and revocation when a supplier leaves; that is plain access control. A leaked key to personal data has to be assessed as a personal data breach.
When accounting software is connected to a bank under PSD2, there is no key you generate yourself but a consent the client gives in the bank, which has to be renewed from time to time. We note when the consent expires and warn the client in advance, so the statement import does not stop in the middle of a monthly close.
What to watch out for
A single shared key for every integration eventually lands in a public repository. Bots find it within minutes, an exported customer database is a reportable incident, and every connection has to be reconfigured at once.
The second problem is the key nobody knows about. When a former supplier or employee set up an integration, the company has no idea where the key runs or what breaks if it is revoked, so it lets it live on. A register of keys with an owner, a purpose and a creation date is the only way to leave no door open during offboarding.
Need the term explained on your own situation? Consulting from €55 / hour excl. VAT, depending on topic and complexity.