API keys identify and authorize software. They can create bills, expose data, or mutate systems, so they need least privilege, rotation, and redaction.
ELI5
Think of API Key as the lock and rules that keep people and data safe. A secret token used to authenticate calls to an API.
In practice
Use it when a workflow touches secrets, permissions, user data, payments, or untrusted input. In practice, define the owner, input, output, and failure mode before you rely on it.