API key
A secret string that identifies the caller and is sent with every request.
What it means
An API key is a long random string issued to an account. The server looks it up on each request to decide who is calling, what they may spend and how fast they may go. Because anyone holding it can act as you, it belongs on a server, in an environment variable, never in browser code or a public repository.
How Onekey handles it
Send the key in the x-api-key header; there is no query-string key, so keys do not land in logs or browser history. A key is shown once when you create it, and only a hash is stored. Revoke a key in the dashboard and it stops working at once. A bad key returns 401 and costs nothing.