Accounts and protecting information

Access key / API key

A string that tells a cloud service or API which application or user a request comes from. Some keys allow access on their own; others work together with separate credentials. What someone can do depends on the permissions and restrictions assigned to that key, rather than everything its owner can do. A stolen key may let an attacker copy information, use paid services or send email within those limits. Publishing a key that should be secret in source code or settings files can also start an incident. If such a key leaks, it needs to be cancelled at once and replaced.