BuyDownload for WindowsMenu

Automation and AI

API key

Also called API token, bearer token, access token, developer API key, Authorization header

Definition

An API key is a long secret string that a program sends with its requests to an API to show which account or app is calling, so the service can allow, limit or refuse the request.

Last updated 7 November 2026

How it works

The service generates a random string and shows it to you once. Your program sends it with each call, usually as Authorization: Bearer <key> or in a custom header. The service checks it, works out which account and permissions it belongs to, and answers. A well-run service stores only a hash of the key, so a leak of its database doesn’t reveal working keys, shows when each key was last used, and lets you revoke one without touching the others.

Why it matters when you run several accounts

A key that can start browser profiles can act in every account those profiles hold, so it deserves the care of a password. Keep keys out of shared scripts and code repositories, give each script or tool its own key so you can revoke one at a time, and remove keys you no longer use.

How SoftGlaze Browser handles it

Developer API keys for the local API are generated in Settings under Developer API Access. They start sg_, are shown once, are stored only as SHA-256 hashes, show when each was last used, and can be revoked. A key isn’t tied to a member or role, so anyone holding one can list and start every profile in the workspace; the docs say so plainly. The local API listens on 127.0.0.1 only and refuses requests whose Host header isn’t the local machine. In the next release, SoftGlaze AI (Beta) adds tokens starting sgai_, each acting as one member with a Read only, Operate or Full scope and an expiry.

Sources

  1. REST Security Cheat Sheet (API keys)OWASP
  2. Authorization headerMDN Web Docs

Outside sources were checked in November 2026. Browsers, standards and vendors' pages change, so details that depend on them are as of that month.

Related terms

  • Browser automationBrowser automation is software controlling a web browser the way a person would, opening pages, clicking, typing and reading results, either from code, from a recorded macro or from an AI app.
  • MCP (Model Context Protocol)The Model Context Protocol (MCP) is an open standard that lets AI applications connect to outside tools and data through MCP servers, which describe the tools they offer so the AI can call them.
  • Team roles (role-based access control)Role-based access control (RBAC) is a way of managing permissions in which each person is given a role, and the role, not the individual, decides what they can see and do.
  • Audit logAn audit log is a time-ordered record of actions taken in a system, saying who did what, to which item and when, kept so that changes can be traced and checked later.

Read more on this site

See it in SoftGlaze Browser

Separate profiles, each with its own cookies, device values and proxy, on Windows. Try the app's screens in your browser first, or start the free trial; no card needed.

Download for WindowsTry the demoAll terms