API key

When a program talks to a service instead of a person clicking around a website, it usually proves who it is with an API key: a long string of characters you get from the provider and put in your code or configuration. Every request carrying that key counts as yours, which means it also gets charged to your account. In practice it is a password that never expires until you retire it.

That is why leaked keys are such a reliable source of misery. They end up in public code repositories, screenshots and pasted snippets, and someone else runs up your bill or reaches your data. Two habits cover most of the risk: never put keys directly in code that gets committed, and if a key is ever exposed, revoke it rather than just deleting the file, because version history keeps the old copy.