What is API key?

Also called secret key, access token, credential.

An API key is a password your website uses to identify itself to another service — Stripe, a database, an email provider. Anyone holding it can act as you on that service, which is why a key in your page source is the most serious thing an audit can find.

In more detail

Many services issue two kinds. A publishable or anon key is designed to be visible in the browser and is safe there. A secret or service role key is not, and bypasses the protections the public one respects. The names differ per provider, which is exactly how the wrong one ends up in the wrong place.

Why it matters for your site

If a secret key is exposed, rotating it is the first step and everything else is second — the old key stays valid until you revoke it, so moving it out of the browser without revoking it changes nothing. After rotating, check the provider’s logs for use you do not recognise.