You finally found the tool that does the thing. It takes your messy meeting notes and turns them into a clean slide outline, the part of deck building you hate most.
You sign up, you start connecting it, and halfway through setup it stops you cold with a little box that says:
Enter your API key.
And you're thinking: I don't have an API key. I build presentations. Nobody said anything about keys.
Deep breath. This is normal, it's not a scam, and you can set it up safely in about five minutes.
As presentation design experts and PowerPoint Speed Trainers who have trained corporate professionals at Nuts & Bolts since 2015, we regularly help non-developers safely connect their daily workflows to AI platforms like OpenAI, Anthropic, and Google without compromising security.
An API key is like a company card number you issue to one specific app: it identifies your account, and everything that app does gets charged to you. It's created separately from your password and only works for that one app, and just like a company card, you can cancel it anytime without touching anything else.
Hold onto that one idea (company card, one per app, cancel anytime) because it answers every question below: what a key is, why apps ask for one, how to keep it safe, what it costs, and exactly what to do if you ever share one by mistake.
So what actually IS an API key?
An Application Programming Interface (API) key is a unique string of characters used to authenticate and authorize a specific application to access a software service. In the context of AI tools, an API key functions as a secure digital account number that connects a third-party app to your provider account, ensuring that any usage is properly tracked and billed to you.
An API key is a long, unique code that tells an AI service (OpenAI, Google, Anthropic) which account to bill when an app uses that service on your behalf. That's it. It's an account number for machines.
It looks intimidating: a string of random characters, something like sk-proj-Xk93f..., which is exactly why it feels like developer territory. But you never memorize it, never type it by hand, and never need to understand what's inside it.
You copy it once from the provider's website, paste it once into the app, and you're done.
The company card comparison holds up better than most tech metaphors:
The card number identifies the company account. The key identifies your AI account.
Every charge on the card flows to the company. Every request the app makes flows to your account.
You'd never paste a card number into a random chat window. Same rule for the key.
If a card leaks, you don't shut down the company. You cancel that one card. If a key leaks, you delete that one key. Your account, your password, and your other apps stay untouched.
That's also why you create a separate key for each app. Stop trusting one, revoke its key, and nothing else breaks.
The metaphor breaks down in exactly one place, and it breaks in your favor: keys can be scoped and restricted in ways a card can't, and you may not even see a charge at first. Google's AI Studio key is free within generous limits, and Anthropic starts new users with a small amount of free test credit.
Treat every key like a secret anyway, even when the service is free. You just may not see a bill.
Why is this app asking ME for a key?
Because until now, the app was doing its AI work on someone else's account (usually the developer's), and it wants the usage, and the bill, to run through yours instead.
Here's what happens behind the curtain when a tool turns your notes into a slide outline:
You hand the app your meeting notes.
The app sends them to an AI provider (OpenAI, Google, or Anthropic).
The provider writes the outline and sends it back.
The usage lands on the account connected to the API key.
The app supplies the workflow. The provider supplies the model that does the writing.
Each round trip costs a fraction of a cent. Multiply that by every user, every day, and the developer is quietly paying for everyone's AI out of pocket.
So a lot of tools flip the arrangement: you supply the AI account the app runs on. There's a name for this (BYOK, or "Bring Your Own Key"), which is industry shorthand for "you pay for your own usage, directly, at cost."
We've been teaching professionals their tools at Nuts & Bolts since 2015, and we're living this exact handoff ourselves right now.
As I write this in July 2026, the AI tools on our newly rebuilt website have been running on our developer's API keys: every image they generate gets billed to his account, not ours. So this week he sent me instructions to create keys of my own at all three providers and paste each one into the site's settings.
The moment a key is saved, that provider runs on our account instead of his.
And that's exactly what the app on your screen is asking of you:
Create a key in your account with the AI provider.
Ctrl + C to copy it
Ctrl + V to paste it into the trusted app.
Let the app run on your account from then on.
This hands you the bill for your own usage, and with it, the dashboard where you watch spending, set limits, and shut the key off.
It also hands you the key itself, and keeping that secret is now your job. More on that in a minute.
Is an API key the same as my password?
No. An API key is a separate credential you create for one specific app, and deleting it never touches your login.
But don't hear "separate from my password" as "less sensitive than my password": a key can spend money on your behalf, so it deserves the same secrecy you'd give a card number.
Here's the side-by-side:
What it protects. Your account password: your whole account: settings, billing, history. An API key: one connection between one app and your account.
What happens if it leaks. Your account password: someone can get into everything and lock you out. An API key: someone can run up usage on your bill (they can't log in to your account with it).
How you kill it. Your account password: a password reset, plus updating it everywhere you reuse it. An API key: delete that one key and make a new one.
That last row is the whole story. A leaked password is a scramble: resetting logins, watching for damage. A leaked key is a sixty-second fix: delete it, make a new one, done.
Where do I actually get one?
From the AI provider's own website. You log in with the account you already have (or create a free one), find the API keys page, and click one button.
No developer credentials, no approval process, no code. The process is the same everywhere:
1. Sign in to the provider's platform.
2. Open the API keys section.
3. Click Create API key.
4. Copy the key and paste it into the trusted app that asked for it.
5. Add billing or prepaid credits if the provider requires them.
One heads-up: these API platforms are separate from the ChatGPT, Gemini, and Claude chat apps you already know. Same company, same login, different front door. Here's where to start with the three major providers.
OpenAI. Go to platform.openai.com. Prepaid credits with a $5 minimum purchase, billed separately from a ChatGPT subscription.
Google AI Studio. Go to aistudio.google.com. Free to start, no card required; the paid tier begins with a $10 prepaid credit.
Anthropic. Go to platform.claude.com (the old console.anthropic.com address redirects there). Prepaid credits, and new users get a small free test credit.
Two quirks before you go key-hunting. First, keys aren't interchangeable: an OpenAI key won't work in a field asking for a Google key, and the app tells you which one it needs (the key itself hints at its owner: OpenAI keys start with sk-, Anthropic keys with sk-ant-).
Second, copy the key the moment you create it. OpenAI and Anthropic show you the full key exactly once, at creation; Google's AI Studio usually lets you view yours again later, but treat every key as show-once and save it right then.
And if you go looking and can't find the key screen? You're in good company: "Where do I find my API key" is a common beginner question on OpenAI's developer forum and in Zapier's help community.
These dashboards were built by developers, for developers, and it shows. If it feels like you wandered into the wrong building, that's the dashboard's fault, not yours.
How do I keep it secret?
To keep your API key secure, follow these four core safety rules:
Never share your key via email, text message, or chat window.
Generate a separate, uniquely named key for every application you use.
Set hard spending limits and disable auto-recharge in your billing settings.
Delete and replace any key immediately if you suspect it has been exposed.
The short version: only paste a key into a tool you trust, and never hand it over by email, text, or an AI chat window.
RULE
Only paste a key into a tool you trust, for a purpose you understand, using a key you can delete later. That one sentence covers nearly everything an office professional needs to know about API key safety.
A developer we work with once told me to text him a key instead of emailing it, and I remember thinking that sounded safer. It's barely better: the key still sits in plain text in message history, backed up to the cloud, findable by anyone who ever gets into either inbox.
Texting is slightly-less-leaky, not safe.
Five habits cover the rest:
Create a separate key for each app, named for the app ("Slide Outline Tool"). Stop using the app, revoke its key, and nothing else breaks.
Don't share your personal key with coworkers; each person creates their own (two minutes, nothing extra, their own off-switch). If you genuinely must send one, use a one-time-view link or a password manager's secure share, then delete the key and issue a fresh one, and every copy in an outbox or text thread goes dead.
Only paste the key into the app's dedicated settings field. Verify the company first and know exactly what the app will use the key for.
Restrict the key when the provider allows it: limit which services it can call, what it can do, or how much it can spend.
Revoke keys you no longer use (create the replacement first, update the app, then delete the old key, so nothing suddenly breaks). Handy side effect: since each app has its own key, the keys page doubles as a list of every app with access, so skim it occasionally and delete any you don't recognize.
One more place a key should never go: an AI chat window. As app builder JJ Englert put it in a public post on X:
“Don't paste your API keys in chat... that key gets sent to their servers and stored as part of your conversation history.”
— JJ Englert (@JJEnglert), in a public post on X, April 2026
That includes asking AI for help with your setup. You don't need to show the real key for anyone to explain where it belongs: use a fake one instead, like sk-proj-1234....
Same rule for screenshots: crop the key out or cover it completely before you share the image.
A Markdown file is not a safe place to store an API key either. Markdown files are useful for prompts, project instructions, and notes, but underneath they are still readable plain-text files. If the file is shared, synced, uploaded, or accidentally made public, the key goes with it.
New to the format? Our plain-English guide explains what a Markdown file is and why AI tools use them.
What does a legitimate request look like? Four tells:
It asks during setup or inside its settings, not out of the blue.
The field is labeled for a specific provider.
It explains why it needs the key.
You can replace or remove the connection later.
A random website, an email, or a chat message asking you to "verify" your API key is a phishing pattern. No real provider or app does that, and the provider never needs you to send back the key it issued.
When in doubt, don't Ctrl + V paste it.
Will I get a surprise bill?
Almost certainly not, and two minutes of settings shrinks the worst case to pocket change.
For typical light office use (turning notes into outlines, tightening slide text, a handful of AI requests a day) expect a few dollars a month. A typical text request costs a fraction of a cent, and even an AI-generated image runs from well under a penny to about 25 cents at the very highest quality tiers. Closer to a sandwich than a software subscription.
One honest caveat: a single click inside an app may trigger more than one request, and image generation, long documents, and automated workflows cost more than short text asks.
So don't guess what each request costs. Limit what the account is allowed to spend:
1. Start with the smallest prepaid balance you're comfortable with.
2. Check the auto-recharge setting during billing setup and switch it off (or cap it low) so an empty balance is a hard stop.
3. Set a hard spending limit when the provider offers one; some "budget" settings only send alerts.
4. Glance at the usage dashboard after your first few days to see what this particular app actually costs to run.
The exact controls differ by provider:
OpenAI. You're prepaid: load credit before anything runs, and when it's gone, requests stop (billing can lag briefly, so a small overage is possible before the cutoff). While you're in billing setup, find the auto-recharge toggle and make sure it's off if you want an empty balance to mean a full stop.
Two more OpenAI specifics worth knowing. Monthly project budgets are alerts, not brakes (OpenAI's own help docs say requests past the budget "continue to be processed without interruption"), but the new opt-in "Enforce a hard limit" spend control, added in July 2026, is a real brake: turn it on and requests past the cap are refused instead of processed.
Anthropic. Prepaid credits plus a true spend limit: hit the limit and usage pauses until next month. Auto-recharge is optional, and you can leave it off.
Google. The free tier doesn't even need a card. On the paid tier your prepaid balance is the ceiling: when it hits $0, the keys on that account stop working, and you can cap how much auto-recharge adds per month (Google's classic Cloud budgets only send alerts).
The low-stress setup for a new app:
Add a small prepaid balance.
Leave auto-recharge off.
Set a hard spending limit if one is available.
Use the app normally for a week.
Check the usage dashboard before adding more credit.
That gives you real evidence about what the app costs instead of a generic estimate. In most cases that first glance settles the money fear for good.
THE WORST CASE, SCOPED
You've probably seen headlines about surprise five-figure API bills. Those come from keys leaked in public code and hammered by bots at scale, or automated workflows left running, not from pasting one key into one trusted app.
A small prepaid balance with auto-recharge off caps the damage at money you already loaded (billing lag can let a small overage slip past the line, not a five-figure one). And if usage ever looks wrong, revoke the key first and investigate second.
I think I shared my key. What do I do?
Revoke it and reissue it. The whole fix takes about 60 seconds:
Sign in to the provider's dashboard.
Open the API keys page.
Delete the exposed key (it's one trash-can click).
Check your recent usage and billing for anything unfamiliar.
Create a new key and paste it into the one app that's supposed to have it.
That's the entire fix, and nothing else in your account is touched.
This is the company card move, and it's the single most reassuring fact on this page.
You don't close the account. You don't change your password. You don't call anyone.
You cancel the one card, and the moment it's gone, every copy of it everywhere (the email you regret, the text thread, the chat log) goes dead at the same time.
KEY INSIGHT
Every API key comes with an undo button. Rotating a key (delete it, create a new one, update the app) is routine maintenance, not an admission you messed up: developers do it on a schedule.
This isn't just my advice, either: it's the official guidance. Anthropic's Claude Help Center guide, "API Key Best Practices," tells users exactly this: if you suspect a key is compromised, revoke it immediately and create a replacement.
That's it. The old key goes dead. OpenAI's version adds two steps: review your recent usage, and contact support if you see activity that isn't yours.
When should I change my password too?
Only if you think someone got into your provider account itself: unfamiliar logins, account changes, purchases, or keys you didn't create. If only the key leaked, revoking the key is the whole fix, and don't wait on support before shutting it off.
So the next time a tool stops you mid-setup and asks for an API key, you don't need to close the tab. It's asking for a company card number: yours to issue, yours to watch, yours to cancel.
Five minutes to set up, a quick fix if you ever slip, and every tool you've bounced off because of that one scary field is back on the menu.
Plenty of people close that tab for good. You stayed and found out what the field was.
And once your new tool starts producing outline text, make sure it lands on your slides cleanly: that's covered in our guide to pasting AI content into PowerPoint and Word without the formatting mess.
Key Takeaways: still wondering about API keys?
Q: Why is this app asking me for my API key?
A: Because the app does its AI work through a service like OpenAI, Google, or Anthropic, and it wants to use your account with that provider instead of supplying its own access.
This setup is commonly called Bring Your Own Key, or BYOK. Any resulting usage is tracked under your provider account and, when applicable, billed there. That also puts the usage history, spending controls, and off-switch in your hands.
Q: Is an API key the same as my password?
A: No. Your password lets you sign in and manage your account. An API key is a separate credential that allows software to make approved requests through that account.
You can revoke an API key without changing your password or affecting your login. But it still deserves card-number secrecy: someone who gets the key may be able to use your API allowance, consume prepaid credits, or create charges through your account.
Q: Will an API key charge my credit card automatically?
A: Not simply because you create or paste the key. The API key authorizes the app to make requests, but whether those requests create charges depends on the billing setup connected to your provider account.
Before connecting an app, open the provider’s billing page. If you are using prepaid credits, start with a small balance and turn off automatic reloading. If your account uses postpaid or pay-as-you-go billing, review its spending controls and alerts. Then check the usage dashboard after your first few sessions.
Prepaid accounts generally stop processing requests when the balance runs out, but do not treat that as a perfectly exact hard stop. Billing can run slightly behind, which may allow a small overage before usage is cut off.
Q: Do I need to know how to code to use an API key?
A: No. You usually create the key in the provider’s dashboard, copy it, and paste it into the app’s settings field.
You may also need to choose a project, review permissions, or set up billing, but you do not need to write code or understand how the API works behind the scenes.
Q: I accidentally shared my API key. What do I do?
A: Revoke the exposed key immediately to prevent anyone from using it through your account.
Sign in to the AI provider’s official dashboard.
Open the API keys page.
Revoke, delete, or disable the exposed key.
Review your recent usage and billing for anything unfamiliar.
Create a replacement key and add it only to the trusted app that needs it.
Revoking the key does not change your password or lock you out of your account. However, any app using the old key will stop working until you give it the replacement. If you see unauthorized usage or charges, contact the provider’s support team after turning off the key.
Q: Is it safe to email or text someone my API key?
A: No. Email and text messages can leave copies of the key in message histories, backups, notifications, and synced devices.
The safer option is for each person to create their own key or receive approved access through the provider’s project or organization. If you must transfer a key, use your organization’s approved password manager or secure secret-sharing tool.
If a key has already been sent through email or text, revoke it and create a replacement.
Q: Where do I find my API key?
A: You create and manage API keys in the provider’s developer platform: the OpenAI API Platform, Google AI Studio, or the Claude Console. These are separate from the regular ChatGPT, Gemini, and Claude chat apps.
Some providers show the complete secret key only when you create it. OpenAI does, for example. If you did not save a key and can no longer see the full secret, create a new one rather than trying to recover the old one.
Q: Can I see my API key again after I create it?
A: Maybe not. Some providers, including OpenAI, show the complete secret key only once, when you create it.
Copy it immediately and either paste it directly into the trusted app that requested it or save it in a secure password manager. If you close the window without saving it, do not panic. Create a replacement key and use that one instead.
The exact behavior varies by provider, but your safest habit is simple: when a new API key appears, save it before leaving the screen.
Q: Does my ChatGPT Plus, Claude Pro, or Google AI Pro subscription include API usage?
A: No. I completely misunderstood this in the beginning too.
The paid chat subscription and the provider’s API are separate products. ChatGPT and the OpenAI API Platform use separate billing systems, and Claude Pro does not include usage through the Claude API or Claude Console.
Google AI Pro pays for features in the Gemini app and certain Google products, while Gemini API usage is managed separately through a Google Cloud project.
Depending on the provider and model, the API may include a free tier or require separate credits or billing. Either way, do not assume your existing chat subscription covers it.
Q: The free Google API key sounds too good to be true. What’s the catch?
A: The biggest catch is privacy, not the price.
On Google’s free Gemini API tier, Google says your prompts, uploaded files, and generated responses may be used to improve its products. Human reviewers may also read and process that content. Google specifically warns users not to submit sensitive, confidential, or personal information through its unpaid services.
On the paid tier, Google says your prompts and responses are not used to improve its products. Moving to the paid tier currently requires many new users to add at least $10 in prepaid credits, although the billing setup can vary by account.
So, use the free tier to experiment with made-up or non-sensitive material. Before working with client decks or company documents, move to the paid tier and confirm that your organization allows that information to be uploaded. It is a meaningful privacy upgrade, but not a replacement for your company’s data policies.
Q: Is an API key the same as adding an app or connector in ChatGPT or Claude?
A: No. Both connect software tools, but they usually ask you to authorize the connection differently.
When you add an app in ChatGPT or a connector in Claude, you typically click Connect, sign in to the outside service, and approve what the AI tool is allowed to access, such as your files, email, calendar, or workspace data. Access may depend on your AI plan, your account with the connected service, and your organization’s permissions.
When an outside app asks for an API key, you create a secret credential through an AI provider such as OpenAI, Google, or Anthropic and paste it into that app. The app can then make requests through your provider account, with the resulting usage tracked and, when applicable, billed there.
The quick tell is:
Click Connect, sign in, and approve permissions: usually an app or connector.
Copy and paste a secret key: an API-key connection.
One honest simplification: integration is the broad word for any setup that lets two tools work together. Apps, connectors, API-key connections, and MCP-powered connections can all be types of integrations.
MCP is the technology behind some newer apps and connectors. It gives AI tools a more consistent way to discover and use outside tools, data, and approved actions. You may never see or paste an API key yourself, but APIs, authentication, and other technical connections may still be working behind the scenes.
The takeaway: you know what an API key is now
So here's where you landed. An API key is a company card number for one app: separate from your password, billed to your account, cancelable in sixty seconds.
More importantly, you know what to ask before pasting one anywhere:
Which provider is this key for?
What will the app use it to do?
Will the usage be billed to my account?
How is the key stored?
Can I restrict or revoke it later?
And the next time someone conflates an API and an API key in a meeting, you can untangle it in one line: the API is how two programs talk to each other, and the API key is the credential that says which account is asking.
You don't need to build either one. You just need to know what you're connecting, what you're granting, and how to shut it off.
You're not in the wrong place. You just speak API key now.
Last verified: July 2026.
About the Author
Taylor Croonquist
Co-Founder, Nuts & Bolts Speed Training
Taylor Croonquist is a PowerPoint expert and trainer. Over a career spanning the globe, from consulting in New York and investment banking in China, Taylor has truly seen it all in PowerPoint. Through necessity and a natural tech savvy, Taylor honed his PowerPoint skills to the point of even blowing the minds of the Microsoft PowerPoint programming team. When he's not busy crafting PowerPoint training, you can find him reading a sci-fi series or scuba diving.