API key
Like a stamped pass at a gate, an API key is a secret your app shows so a service knows the request is from you.
Services such as Stripe, Supabase, Resend, and Modal issue these secrets to your account. Each one ties actions in their system to you, so they can allow or deny requests and know whose bill to attach them to.
This matters because many parts of your app depend on outside services. Use keys to create users, send email, run jobs, or take payments. Keep secret keys only on the server, code that runs on a computer you control, not on the phone.
In practice: you copy a long string of letters and numbers from a provider’s settings page, paste it into a secret setting, and never ship it inside the app. Some services provide a public key safe to use in the app and a secret key that must stay off the device. If one leaks, make a new key and disable the old one in the provider’s dashboard.