API key
A credential that identifies an application or caller to an API, usually as a secret value sent with requests to authorize access to a service.
What it is
An API key is a service-issued credential for identifying a program or integration. It is often sent in a request header or query parameter, so anyone who obtains it may be able to act within its configured permissions and spend the owner's quota. Treat an API key as a secret, keep it out of source control, and prefer narrow scopes where the provider supports them.
How it relates to Orbit
Image Studio can use your own provider key instead of studio credits. See /docs/reference/image-studio/ for details.
When you would use it
You use an API key when a server-to-server integration needs to authenticate requests without a user interactively signing in for every call.
Common operations
- Creating a key for a service integration and storing it in a Vault or environment variable.
- Restricting, revoking, and rotating a key when a team member leaves or a leak is suspected.