# What is an API key? | SoftGlaze Browser glossary > An API key is a secret string that identifies a program calling an API. How keys work, how to keep them safe, and how SoftGlaze issues and revokes them. - Canonical URL: https://browser.softglaze.com/glossary/api-key - Last updated 2026-11-09 --- [Automation and AI](https://browser.softglaze.com/glossary?category=automation-and-ai) ## API key Also called API token, bearer token, access token, developer API key, Authorization header Definition An API key is a long secret string that a program sends with its requests to an API to show which account or app is calling, so the service can allow, limit or refuse the request. Last updated 7 November 2026 ### How it works The service generates a random string and shows it to you once. Your program sends it with each call, usually as `Authorization: Bearer ` or in a custom header. The service checks it, works out which account and permissions it belongs to, and answers. A well-run service stores only a hash of the key, so a leak of its database doesn’t reveal working keys, shows when each key was last used, and lets you revoke one without touching the others. ### Why it matters when you run several accounts A key that can start browser profiles can act in every account those profiles hold, so it deserves the care of a password. Keep keys out of shared scripts and code repositories, give each script or tool its own key so you can revoke one at a time, and remove keys you no longer use. ### How SoftGlaze Browser handles it Developer API keys for the local API are generated in Settings under Developer API Access. They start `sg_`, are shown once, are stored only as SHA-256 hashes, show when each was last used, and can be revoked. A key isn’t tied to a member or role, so anyone holding one can list and start every profile in the workspace; the docs say so plainly. The local API listens on 127.0.0.1 only and refuses requests whose Host header isn’t the local machine. In the next release, SoftGlaze AI (Beta) adds tokens starting `sgai_`, each acting as one member with a Read only, Operate or Full scope and an expiry. ### Sources 1. [REST Security Cheat Sheet (API keys)](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html) OWASP 2. [Authorization header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Authorization) MDN Web Docs Outside sources were checked in November 2026. Browsers, standards and vendors' pages change, so details that depend on them are as of that month. ### Related terms - [Browser automation](https://browser.softglaze.com/glossary/browser-automation) Browser automation is software controlling a web browser the way a person would, opening pages, clicking, typing and reading results, either from code, from a recorded macro or from an AI app. - [MCP (Model Context Protocol)](https://browser.softglaze.com/glossary/model-context-protocol) The Model Context Protocol (MCP) is an open standard that lets AI applications connect to outside tools and data through MCP servers, which describe the tools they offer so the AI can call them. - [Team roles (role-based access control)](https://browser.softglaze.com/glossary/role-based-access-control) Role-based access control (RBAC) is a way of managing permissions in which each person is given a role, and the role, not the individual, decides what they can see and do. - [Audit log](https://browser.softglaze.com/glossary/audit-log) An audit log is a time-ordered record of actions taken in a system, saying who did what, to which item and when, kept so that changes can be traced and checked later. ### Read more on this site - [Docs: local API](https://browser.softglaze.com/docs/automation#local-api) - [Docs: SoftGlaze AI tokens](https://browser.softglaze.com/docs/ai-agents#create-a-token) - [Docs: the local API won't answer](https://browser.softglaze.com/docs/troubleshooting#the-local-api-wont-answer) ### See it in SoftGlaze Browser Separate profiles, each with its own cookies, device values and proxy, on Windows. Try the app's screens in your browser first, or start the free trial; no card needed. [Download for Windows](https://browser.softglaze.com/download) [Try the demo](https://browser.softglaze.com/demo) [All terms](https://browser.softglaze.com/glossary)