What is an API key and how to store it safely

You signed up for an AI API and the first thing it asks for is a key. This guide explains what an API key is, where it comes from, how to keep it safe and what to do if it ends up where it shouldn't.

What an API key is#

An API key is a long string of letters and digits that tells the service who is sending a request. Think of it as a password for programs: your script sends the key with every request, and the service uses it to find your account and take the cost of the request from your balance.

Two things follow from that:

• Whoever has the key can spend your balance. The service cannot tell you from someone who copied your key.
• The key is not the model and not the balance. It is only the pass. The balance is a separate thing you top up, and the same key works with any model your account can use.

The cost of a request is counted in tokens. If tokens are new to you, start with What is a token in AI?.

Where to get a key#

Every AI service issues keys from its own dashboard. For example, DeepSeek's official API has an API keys page at platform.deepseek.com/api_keys, and its docs read the key from the DEEPSEEK_API_KEY environment variable (checked on 21 October 2026). The general flow is the same almost everywhere:

1. Create an account.
2. Open the API keys page in the dashboard.
3. Press the button that creates a new key and give it a name, for example my-first-script.
4. Copy the key right away. Many services show it only once.

With CheapTokens, the steps from account to key are in Your first API request with CheapTokens. CheapTokens works from a prepaid USD balance: one balance for all models. If a request fails because the balance is empty, see "Not enough tokens" error.

Where a key must never be#

Most leaks are not hacks. They are copy-paste mistakes:

• a key written directly in the code (api_key="sk-...") and then pushed to GitHub;
• a key in a screenshot, a chat message or a question on a forum;
• a key in front-end code (a web page or a mobile app): anyone can open it and read it;
• a .env file that was committed to git.

The last one is the most common. Even if you delete the file in the next commit, the key stays in the git history, so a key that was ever committed must be treated as leaked.

Store the key in an environment variable#

An environment variable is a named value that lives in your system, not in your code. The program reads it when it starts, so the code can be shared safely and the key stays on your machine.

In Linux or macOS, set it for the current terminal:

export CHEAPTOKENS_API_KEY="YOUR_API_KEY"

In Windows PowerShell:

$env:CHEAPTOKENS_API_KEY = "YOUR_API_KEY"

This lasts until you close the terminal. To keep it between sessions, put the line in your shell profile, or use a .env file for the project and add it to .gitignore before the first commit:

# .gitignore
.env

Then read the key in code. Never type it there:

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://api.cheaptokens.dev/v1",
    api_key=os.environ["CHEAPTOKENS_API_KEY"],  # read from the environment, not written in the code
)

If the variable is missing, os.environ[...] stops the program with an error right away, which is better than sending a request with an empty key.

Make a first call#

CheapTokens speaks the OpenAI Chat Completions and Anthropic Messages formats, so the standard SDKs work: you only change the base URL and the key. Here is a full test with MiniMaxAI/MiniMax-M2.7:

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://api.cheaptokens.dev/v1",
    api_key=os.environ["CHEAPTOKENS_API_KEY"],
)

response = client.chat.completions.create(
    model="MiniMaxAI/MiniMax-M2.7",
    messages=[{"role": "user", "content": "Explain what an API key is in two sentences."}],
    max_tokens=200,
)

print(response.choices[0].message.content)

The same with curl, where the shell substitutes the variable and the key never appears in the command:

curl https://api.cheaptokens.dev/v1/chat/completions \
  -H "Authorization: Bearer $CHEAPTOKENS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "MiniMaxAI/MiniMax-M2.7", "messages": [{"role": "user", "content": "Hello"}], "max_tokens": 100}'

A short test like this is cheap. For example, a request with 1,000 input tokens and 500 output tokens costs $0.00013 at the current price. MiniMax-M2.7 also has a 180K context and gives answers of up to 8,192 tokens, so it is a comfortable model for first experiments. If the answer stops mid-sentence, see Why does an AI answer stop mid-sentence?.

Copy the model id from the CheapTokens docs rather than from another service: model names differ between providers.

Habits that keep a key safe#

• One key per project. If one leaks, you replace only that one and nothing else stops working.
• Give keys names that say where they are used (laptop-script, telegram-bot), so you know what to update after a replacement.
• Keep the balance small while you are learning. With a prepaid balance, the damage from a leaked key is limited by what is on it, but that is still your money.
• Don't paste keys into chats with people or AI assistants, and cut them out of logs and screenshots.
• Don't put the key in a browser or mobile app. Call the API from a server you control, and let the app talk to that server.

What to do if a key leaked#

If you pushed a key to a public repository, sent it in a message or just aren't sure, act as if it is already in someone else's hands:

1. Revoke the key first. Open the page where you created it and delete or disable it. Do this before anything else; cleaning up comes after.
2. Create a new key with a new name.
3. Replace it everywhere it was used: environment variables, .env files, servers, apps and tools.
4. Check your balance and usage. Requests you didn't make are a sign that the old key was used.
5. Clean up the source. Remove the key from the code and add .env to .gitignore. Deleting the file does not remove the key from git history, which is why step 1 matters more than rewriting history.

The order is important. A revoked key is harmless even if it stays in an old commit.

Next steps#

• Make your first request with a key: Your first API request with CheapTokens.
• Understand what you pay for: What is a token in AI?.
• Top up the balance when it runs out: "Not enough tokens" error.

Ready to try it? Get a CheapTokens key, set it as CHEAPTOKENS_API_KEY and run the example above.

Endpoints, model ids and limits for every model are in the CheapTokens docs.