API Key
An API key is a unique identifier used to authenticate requests to an application programming interface. API keys are commonly used for programmatic access, rate limiting, and usage tracking. They are the simplest form of machine authentication but carry significant security risks when mismanaged.
Why It Matters
API keys are a form of non-human identity. Unlike OAuth tokens, they typically do not expire, are not scoped to specific operations, and are not tied to a specific user. A leaked API key provides persistent, broad access until it is manually revoked.
AI agents that use API keys for authentication are particularly vulnerable to credential theft through prompt injection. If the API key is stored in the agent's configuration or context, an adversarial prompt can extract it. Credential mediation solves this by keeping the key outside the agent's context entirely.
Best practices for API key management include automatic rotation, scope limitation, usage monitoring, and storage in secrets management systems (vaults) rather than configuration files or environment variables.