What is an API key? A plain-English guide with Reddit and X examples

An API key is a secret string that identifies your program when it calls someone else's API. The service gives you one, your code sends it with every request (usually in an HTTP header), and the service uses it to decide whether to answer, what you're allowed to do and whom to bill. If you've ever pasted a long jumble of letters into a .env file, that was an API key.

This guide covers what an API key is in plain English, how it differs from a token or OAuth, and what keys look like on three real APIs: Reddit, X and ChatterAPI. Each example follows the provider's current docs, checked on October 17, 2026.

What is an API key, in plain terms?

Think of a key card for an office building. The card doesn't say who you are as a person. It tells the door that it belongs to an account allowed in, and the building logs every swipe against that account. An API key does the same job for software:

• It identifies the caller, telling the API which account or project is making the request.
• It authorizes the caller, deciding what they can reach: read-only or read-write, test or live data, which endpoints.
• It meters usage. Every call is counted against the key, which is how rate limits and billing work.

The big difference from a key card is that an API key is just text, so anyone who copies it can use it. A leaked key can run up your bill, burn your quota, or read data you're allowed to see. Most of the advice later in this post follows from that.

How an API key works in a request

Usually the key goes in an HTTP header. Your program builds a request, adds the key, and sends it. The most common header is Authorization: Bearer <key>, a format defined for OAuth tokens in RFC 6750 that many key-based APIs now use as well.

Here is a real request to ChatterAPI, which follows that pattern. The key sits in an environment variable, and the request asks for a subreddit's details through GET /v1/reddit/subreddits/{name}:

export CHATTERAPI_KEY="ca_live_..."   # from your dashboard, never from source code

curl "https://api.chatterapi.com/v1/reddit/subreddits/learnprogramming" \
  -H "Authorization: Bearer $CHATTERAPI_KEY"

The response was captured live on October 17, 2026. It's trimmed here to the main fields, though rules and moderators come back too:

{
  "data": {
    "name": "learnprogramming",
    "title": "learn programming",
    "description": "A subreddit for all questions related to programming in any programming language (Contributions are only allowed in English!).",
    "subscribers": 4421765,
    "createdAt": "2009-09-24T04:25:37.000Z",
    "nsfw": false,
    "url": "https://www.reddit.com/r/learnprogramming/"
  },
  "credits": { "charged": 2, "remaining": 52 },
  "requestId": "req_01M550524JPHND7QJM48",
  "cached": false
}

The credits block handles metering. The key's account paid 2 credits for that call and has 52 left.

What happens with a wrong or missing key

The API refuses the call before it does any work. We got these two responses on October 17, 2026, the first with a made-up key and the second with no header at all. Both returned HTTP 401 and cost nothing:

{
  "error": {
    "code": "invalid_key",
    "message": "Unknown API key.",
    "retryable": false,
    "docsUrl": "https://chatterapi.com/docs/errors#invalid_key"
  }
}

{
  "error": {
    "code": "missing_key",
    "message": "Add the header Authorization: Bearer <your API key>.",
    "retryable": false,
    "docsUrl": "https://chatterapi.com/docs/errors#missing_key"
  }
}

Most APIs do the same thing: they return a 401 status (sometimes 403) and an error code your code can check for. The errors guide lists every code ChatterAPI returns.

API key vs token vs OAuth

People use these words loosely. Here is how they differ.

The two often work together. Many platforms give you a key (or a client id and secret) and have you exchange it for a token, and Reddit and X both work this way.

Example 1: Reddit's API credentials

Reddit doesn't hand out a single API key. You register an app to get a client id and client secret, then exchange them for an OAuth access token that your code sends as Authorization: bearer <token>. Reddit's API documentation lists the endpoints that token can call.

In 2026 the hard part is getting those credentials. Since November 2025, new apps have needed Reddit's approval under its Responsible Builder Policy. On September 30, 2026, Reddit announced that it will stop accepting new public API access requests on October 31, 2026, and will close the remaining public access in March 2027 (r/redditdev, checked October 17, 2026). For the full process, and what to do if you're turned down, see how to get a Reddit API key.

Example 2: The X API key and bearer token

X gives each app an API Key and API Secret (sometimes called the consumer key and secret). For read-only calls on public data, you exchange them for an app-only bearer token. Per X's app-only authentication docs, checked October 17, 2026, you Base64-encode key:secret, send it to POST /oauth2/token with grant_type=client_credentials, and get back an access_token whose token_type is bearer.

With that bearer token you can read public timelines, followers and lists, and search posts. You can't post, send DMs or read anything private. Those need a user-context token through OAuth.

X bills calls to the account behind those credentials. Its pricing page (checked October 17, 2026) lists pay-per-use rates, for example $0.005 per post read. For the whole setup, see our guide to getting an X API key.

Example 3: A ChatterAPI key

ChatterAPI uses a single key. You sign up with Google, create a key on the dashboard's Keys page, and send it as a bearer header. The same key works for Reddit and X, over REST and through the hosted MCP server at https://api.chatterapi.com/mcp. The authentication guide has the details.

There are two kinds of key, and the prefix tells you which one you have:

• ca_live_... keys make real calls and spend credits.
• ca_test_... keys return one recorded real response per endpoint for free, no matter what you send. Use them for building and CI. See test keys.

If you issue keys in your own systems, give them a prefix that names the environment too. That way a live key pasted into the wrong place stands out, and secret scanners can match your keys by pattern.

How to keep an API key safe

A key only works as an identity while it stays secret. These habits cover nearly every real leak:

1. Keep keys out of source code. Read them from an environment variable or a secret manager, and add .env to .gitignore before your first commit.
2. Never ship a key to a browser or mobile app. Anything in front-end JavaScript or an app bundle is public, so call the API from your server and send the results to the client.
3. Use one key per app or environment. If one leaks, you revoke that key instead of breaking everything.
4. Turn on secret scanning. GitHub scans repositories for known secret formats and can block pushes that contain them.
5. Rotate whenever you're in doubt. If a key shows up in a log, a screenshot or a chat, revoke it and make a new one. It takes a minute.
6. Watch usage. A sudden jump in calls is often the first sign a key has leaked.

The OWASP Secrets Management Cheat Sheet covers the same ground for larger teams, including central storage, access control and audit logs.

Reading a key from the environment in Python

import os
import requests

key = os.environ["CHATTERAPI_KEY"]  # fails loudly if the variable is missing
r = requests.get(
    "https://api.chatterapi.com/v1/reddit/subreddits/learnprogramming",
    headers={"Authorization": f"Bearer {key}"},
    timeout=30,
)
if r.status_code == 401:
    raise SystemExit(r.json()["error"]["message"])
print(r.json()["data"]["subscribers"])

Are API keys enough on their own?

Some security engineers argue that long-lived keys are the weak point. They never expire, they get copied into scripts and CI logs, and anyone holding one has full access. Short-lived OAuth tokens and signed requests limit the damage when a credential leaks.

That's a fair point. It's why platforms that act for users use OAuth, X included when it posts on someone's behalf. For server-to-server calls on your own account a key is still the normal choice, provided it stays on the server and you can revoke it quickly. It's also why ChatterAPI's X write actions run from accounts you connect in the dashboard, not from anything you paste into code.

Try it with a free key

Sign up with Google to get 100 free credits without entering a card. Create a key, export it as CHATTERAPI_KEY, and run the curl call above. If the response shows "charged": 2, your key works.