API key
DEFINITION
An API key is a secret string that an application sends with each request to identify and authenticate itself to an API, such as Recurly's billing API.
TABLE OF CONTENTS
RELATED TERMS
An API key is a secret string that identifies and authenticates an application when it calls an API. The application sends the key with each request, and the service uses it to confirm the request comes from a known, authorized source before it responds.
An API key works like a credential for software rather than a person. When one system needs to talk to another over an API, the key tells the receiving service who is calling and what they are allowed to do. Because the key grants access, it has to be kept secret, since anyone who holds it can act as that application. In a subscription business, API keys authenticate the connection between a billing platform and a website, app, or internal system, so that signups, plan changes, and payments can flow between them securely. A subscription platform such as Recurly issues API keys so a business can connect its own systems to the platform's API.
Why API keys matter for subscription businesses
A subscription business rarely runs its billing in isolation. The billing platform has to exchange data with the website where customers sign up, the app they use, and the internal tools that track revenue. API keys are what make those connections trusted, so that only authorized systems can create subscriptions, read customer data, or trigger charges. Without that control, any system could call the API, which would put customer and payment data at risk.
Because a key carries real access, how it is handled is a security matter. A leaked key can let an outsider read data or make changes as if they were the business, so keys should be stored securely, scoped to only what they need, and rotated if they may have been exposed.
How API keys work
The business generates an API key in the platform, which creates a unique secret string.
The business stores the key securely and configures its own system to use it.
When that system calls the API, it includes the key with the request.
The service checks the key and confirms the caller is authorized.
If the key is valid and has the right permissions, the service processes the request.
If the key is missing, invalid, or lacks permission, the service rejects the request.
How to use API keys
Generate separate keys for separate systems so you can track and revoke them independently.
Store keys as secrets, never in client-side code or a public repository.
Scope each key to only the access it needs rather than full access by default.
Rotate keys on a schedule and immediately if one may have been exposed.
Watch for test versus live keys so test activity never touches real billing.
Benefits and examples
Only systems with a valid key can call the API, so access stays controlled.
Connected systems can create subscriptions and process payments without manual steps.
Separate keys make it clear which system made which calls.
A key that is scoped and rotated limits the damage if it leaks.
For example, a subscription business connects its signup page to its billing platform using an API key. When a new customer signs up, the page calls the billing API with the key to create the subscription and charge the first payment. The key is stored securely on the server, never in the customer's browser, and it is scoped so it can create subscriptions but not perform unrelated administrative actions.
Frequently asked questions
What is an API key? It is a secret string that identifies and authenticates an application when it calls an API, so the service can confirm the request comes from an authorized source.
Why does an API key need to be kept secret? Because the key grants access to the API. Anyone who holds it can act as that application, so a leaked key can expose data or allow unauthorized changes.
What is the difference between a test key and a live key? A test key is used against a test environment so activity does not affect real customers or payments, while a live key operates on real data. Keeping them separate prevents test calls from touching production billing.
What should I do if an API key is exposed? Rotate it right away, which means generating a new key and retiring the old one, then update the systems that used it. Scoping keys narrowly limits the damage in the meantime.
