API Key
Also known as: API token, secret key.
In plain English
When you build software that calls an AI model, you don't log in with a password on every request — you send an API key in a header, and the provider uses it to authenticate the call, enforce your rate limits, and meter your usage for billing. Keys are powerful and dangerous: anyone holding one can run up charges on your account, so the rules are strict. Keep keys in server-side environment variables or a secrets manager, never in client-side JavaScript, mobile apps, or a public Git repo (scrapers find leaked keys within minutes). Rotate keys periodically, and immediately if one leaks; scope them with minimal permissions and spending caps where the provider allows. Managing keys across several providers is one of the frictions of building directly on model APIs — a large part of what BYOK setups and aggregator platforms exist to simplify.
Example
A developer hardcodes their OpenAI API key into a website's front-end JavaScript to 'just get it working.' Within a day, a bot scrapes the key from the page source and racks up thousands of dollars in charges before the provider's fraud alert fires. The fix: move the key to a server-side environment variable, proxy the model call through a backend, and rotate the exposed key immediately. A key in client code is a key already leaked.
API Key in Vincony
Vincony's managed, credit-based account removes the need to juggle provider API keys for everyday use — one login covers 750+ models across 80+ providers, so there's nothing to leak, rotate, or run up surprise charges. The docs cover account access and integrations.
Browse the docsTry it — 750+ distinct models across 80+ providers on one account
Vincony bundles GPT-5, Claude, Gemini, Perplexity Sonar Pro, DeepSeek, Mistral, and 750+ other models on one $0/month account.