API key
Also: 金鑰 · API 金鑰 · access token · secret key
A secret string that tells a remote service "this request is yours, and the bill is yours".
When you will meet it
Every tool that calls a model API needs one. It is both your identity and your wallet — leaking it is like posting your card number on a noticeboard.
An analogy
Like an office badge: it opens doors and leaves a record, and you revoke it the moment it is lost. Except this one spends your money.
Minimal example
import os
from openai import OpenAI
# 從環境變數讀，不要把 key 寫在這裡
client = OpenAI(api_key=os.environ["OPENAI_API_KEY"])The point is os.environ[...]: the code can be public because the key is not in it.
What people get wrong
- Hardcoding it and pushing to GitHub. Bots find and abuse such keys within minutes.
- Pasting it into a chat window when asking for help with an error. Redact it first.
Related terms
Next
- 第一次呼叫 LLM API：Token、計費與常見錯誤21 minChinese only