An API key is a secret string that identifies and authorises a program making requests to a service, so the service knows who is calling and which account to bill. For AI providers, the key is the credential that both authenticates each model call and ties the resulting token usage to your account, which means anyone holding the key can spend money on your behalf. Keys usually carry a recognisable prefix that signals the provider: OpenAI keys begin sk-..., Anthropic keys begin sk-ant-..., and OpenRouter keys begin sk-or-....
What does an API key do?
An API key serves three jobs at once. It authenticates the caller, so the provider accepts the request. It authorises usage, often within limits or scopes you set on the key. And it attributes billing, so the tokens you consume land on the right account at the provider's published rate. Because that one string can spend money, an API key is treated as a secret: you create it in the provider dashboard, paste it once into the tool that needs it, and never share or commit it to code.
API keys in BYOK tools
BYOK (bring your own key) is the pattern where you supply your own provider API key to a third-party tool instead of using the tool's own key. In ReplyLabs, you paste an OpenAI, Anthropic, Google, Mistral, or OpenRouter key into the Google Sheets add-on, and AI runs across your rows on that key. The provider bills your account directly at raw cost, with no platform markup on the model call. The alternative is managed mode, where the tool holds its own key and bills you a price that includes a margin (ReplyLabs managed AI is the provider's raw cost times 1.25 plus $0.0025 per succeeded row). For the full comparison see the BYOK glossary entry and the bring your own API key page.
How API keys should be stored
Because an API key can spend money, storage is the part that matters most. A well-behaved tool encrypts every stored key at rest, decrypts it only at the moment a call is dispatched, never renders it back to the screen after saving, and never writes it to logs or history. ReplyLabs encrypts stored keys with AES-256-GCM, an authenticated scheme that both conceals the value and detects tampering, and replaces or deletes the value when you rotate or remove a key. Many providers also let you cap a key with a spend limit, which bounds the worst case if a key is ever exposed.