API key

An API key is the simplest credential an API can issue: a long random string tied to an account or project, sent with every request — usually in a header such as X-API-Key, sometimes in the query string. It identifies who is calling, for billing, quotas and access control, but carries no expiry or scope of its own unless the server attaches them.

How it works

The server looks the key up on each request, rejects unknown ones with 401 and applies that key's quota and permissions. Keys are typically created in a dashboard, can be rotated by issuing a new one before revoking the old, and are often restricted to particular IP ranges, referrers or endpoints.

The misconception

That a key in a query string is as safe as one in a header. URLs are written to server logs, proxy logs and browser history and can leak through the Referer header; a header is not secret either, but it does not end up in nearly as many places.

Try it here

The Cargo Tracking API requires X-API-Key on its writes — POST /cargo/v1/shipments and the state-machine transitions — while its reads are open, so the same API shows both sides.

Related

• What a bearer token is
• Cargo Tracking API docs

Other terms

• Mock API — A stand-in for a real API that returns realistic responses without the real system behind it.
• REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
• ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes.
• HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next.
• Bearer token — A credential where possession alone grants access — whoever holds it can use it.
• JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 2 October 2026