An API key is a long string of random letters and numbers that a service hands you so that a program can use the service on your behalf. It is a password for software rather than for a person. Your AI tool is asking for one because the app you are building needs to talk to an AI model while people use it, and every one of those requests has to be tied to an account that can be billed. The key is how the model’s provider knows whose account that is.
What the key is and where it comes from
API stands for application programming interface, which is a formal name for a door that a service opens for other programs. Your app knocks on that door with a request, and the key travels with every knock. The service checks it, does the work, and adds the cost of that work to the account the key belongs to.
Keys are issued by the service, not by your builder. Anthropic issues Claude keys from the Claude Console, its developer site. OpenAI issues keys from its API platform. Google issues Gemini keys from Google AI Studio. In each case you create an account, click a button to make a key, and copy it. It looks like nonsense on purpose: nobody is meant to remember it, only to store it somewhere safe for a program to read.
Why your chat subscription does not count
This is the confusion behind “what is an API key for Claude.” If you pay for Claude, you have a subscription for chatting, and a paid subscription also includes Claude Code, the builder you type to. Neither comes with an API key. Anthropic says plainly that its paid plans and the Console are separate products for different purposes: one is for you to use Claude, the other is for building things that use Claude. OpenAI draws the same line, with ChatGPT and its API platform billed separately.
Once you build an app there are two AIs in your life. The one you talk to while building runs on your subscription. The one your finished app calls for its users runs on a key, with its own account and its own bill.
If you built with Lovable or Base44, you may never have seen a key, because the builder stood between you and the door. Lovable generates and manages a key for each project and charges your app’s AI usage to your credits through its own gateway. Base44’s built-in features work with no separate API key on any plan, and it only asks you for one when you connect a provider of your own. The day you move to a builder that writes files on your computer, there is no gateway, so your app needs a key of its own. That is why the question arrives now.
Is an API key free?
The key is free. What costs money is what it is used for. Each request your app sends is metered and charged to the account behind the key, so the bill grows with use and drops to nothing when nobody opens the app.
Providers differ in how they collect that money. Anthropic bills API use through prepaid credits: you load money first, and successful calls draw it down. OpenAI’s platform bills separately from ChatGPT, also with prepaid purchases. Google’s Gemini API has a free tier for getting started before paid pricing begins. Prices live on each provider’s pricing page and change often, so check there.
One trap if you use Claude Code. If an Anthropic API key is stored on your computer as an environment variable, which is a setting your computer keeps for programs to read, Claude Code will use that key instead of your subscription and bill your Console account per use. Typing /status inside Claude Code shows which one it is using.
Why the key must never sit in a page
A web page is not shown to a visitor. It is sent to them. Every line of it lands in their browser, and anyone who knows where to look can read it, including a key you pasted in so the page could call an AI. Google’s docs say keys compiled into client-side code can be extracted by users, and OpenAI’s say embedding a key in an application makes it vulnerable to misuse. Your builder is describing how the web works, and it is right to be strict about it.
The safe home for a key is on a server, a computer your visitors never see, in a locked place the code reads from while it runs. Lovable calls that place Secrets: values are encrypted, handed to your backend automatically, and never reach the browser. Base44 has Secrets in its Dashboard, stored encrypted and never sent back to the browser. On your own computer the equivalent is a small settings file that stays out of the code and never gets uploaded.
Two other places a key does not belong: a chat window and a public code repository, the online folder where code is stored. Anthropic says accidental exposure in public repositories and third-party tools is one of the most frequent causes of key leaks. Lovable now watches for keys pasted into its chat and stores them as secrets instead.
What happens when one leaks
Someone else’s requests get billed to you. Anthropic puts it in one sentence: if someone obtains and uses your key, they incur charges on your behalf. OpenAI lists the rest: unexpected charges, a used-up quota, and your own app losing access when the account hits its limit.
The fix has an order. Revoke the key at the service that issued it first, because the old key keeps working until it is dead, and deleting it from your code later does not undo the leak. Then make a new key and put it somewhere the browser cannot reach.
You can learn more, and get the full prompts and the decision tables, in our course, starting from You’ve Outgrown Lovable. The first lesson is free, no card.
In the next ten minutes: open the provider’s site and look at whether your account has a key you have forgotten, and what its usage page shows. If you have ever pasted that key into a chat, a page, or a shared document, delete it there and make a fresh one. Then ask whether your app generates anything at all, because an app that only stores and sorts what people type does not need a key yet.