An API key is a password your code sends with every request so a service knows who is calling and what to bill. Using one takes five minutes. Protecting it comes down to three habits: scope it, store it in environment variables, and let secret scanning catch your mistakes.