Short answer. An API key is a secret string that identifies the software calling a service and lets it use the service without a login screen. Whoever holds the key can act as its owner, which is why OpenAI tells developers not to share it or put it in browser or app code, and to load keys from an environment variable or a key management service on the server. OWASP lists API keys with database credentials, SSH keys and certificates as secrets to centralise, rotate and audit. Example: a script that summarises incoming emails uses one key. If someone pastes that script into a shared chat, anyone who reads it can spend your money and read your data.
01
What a key does, and does not do
A key identifies the caller and, depending on the service, limits what the caller may do. In OpenAI’s and Anthropic’s APIs the key travels with each request as a bearer credential in the Authorization header; Anthropic still accepts an older x-api-key header as a fallback.
The bearer model is simple and unforgiving. RFC 6750 defines a bearer token as one that any party in possession of it can use in the same way as any other holder, and that does not require the holder to prove possession of a cryptographic key. The service checks that the key is valid, not who is holding it. The same RFC makes TLS mandatory for carrying such tokens, so a key sent over plain HTTP can be read on the network.
02
Where keys leak
Source code that is shared, emailed or pushed to a public repository. OWASP notes that many organisations hardcode secrets in plaintext in source code and configuration files.
Chat messages, tickets and shared documents.
Browser or mobile app code, where anyone can read it.
A spreadsheet of passwords kept by one helpful person.
Logs and error messages that print request headers.
Old keys that nobody revoked after a person or a project left.
03
Good practice
Practice
Why it matters
Where it comes from
One key per person or application
You can tell who did what, and revoke one key without stopping everyone
OWASP: shared secrets make the source of a leak hard to identify
Narrow scope
A leaked key can do less
OpenAI keys belong to a project, and administrators can restrict which types of key may be created
Expiry and rotation
A stolen key stops working after a while
OpenAI recommends an expiry date and a regular rotation process; OWASP recommends regular rotation
OpenAI: revocations take effect within a few seconds
Watch usage
Misuse shows up early
Pair keys with rate limits and alerts
04
If a key leaks
Revoke it in the provider’s console straight away.
Create a replacement and update the application that needs it.
Check usage for the whole period the key was exposed.
Find how it leaked and remove it there. Repository history keeps old versions.
Tell the owner of the data if client information may have been read.
05
Keys on a private AI endpoint
A local model server can speak the same OpenAI-compatible format without checking keys. Ollama’s own documentation shows the key as required by the client library but unused by the server. On an endpoint that ignores the key, anyone who can reach the address can use the model, and the log cannot say who.
That is why per-user keys matter on a shared office system: they tie each request to a person or an agent and allow limits for each. ANVE’s governed API, with a key per user or agent and every request in the audit trail, is not on ANVE yet. Today the models are reachable through the runtime’s own OpenAI-compatible endpoint (Ollama or vLLM).
06
Questions people ask
Is an API key a password?
It plays a similar role but is meant for software, not people. It is usually long, random and tied to a project or account. Treat it with at least the care you give a password.
What should I do if I paste a key into a chat or a public repository?
Revoke it at once and create a new one. Deleting the message is not enough, because copies and history may remain.
Should staff share one key?
No. A shared key hides who did what, and forces you to replace the key for everyone when one person leaves. Give each person or application its own.
Does a local AI server need an API key?
Not technically: Ollama ignores the key in its OpenAI-compatible mode. On a shared office system you still want one per user, so that requests can be attributed and limited.
07
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
