API key

A token identifying the caller on each request, used to apply quotas, rate limits, and billing.

An API key answers 'who is calling', not 'should this call be allowed' — it is identification, not authorization. Keys leak through client-side code, logs, and screenshots, so treat rotation as routine rather than an incident response.