# What is an API (and an API key)?

> An API is a structured messenger contract that lets your app's backend ask another service (such as an AI provider) for work over the internet, and an API key is the private password your server sends to prove it has permission and pay for that request.

## Analogy

An API is like a standardized order slip between a hotel kitchen and a trusted bakery across town: your kitchen sends a precise request (“12 croissants, plain”) and gets back a structured box. The API key is the hotel's charge-account stamp on the slip—anyone who steals that stamp can order pastries on your bill.

## How it works

Programs don't click buttons to talk to each other; they use an api (Application Programming Interface). Your app's backend sends an HTTPS **request** formatted as structured text (JSON) to a specific address—such as `https://api.tokentide.app/v1`—and receives a structured JSON **response** a moment later.

Because external services cost money or hold private data, they require an api-key on every request. For example, a Tokentide key starts with `tt_live_` and is shown only once when you create it. Whoever has that key can spend your prepaid balance, which is why you always set a daily spending cap and use a separate low-cap key for local development.

Your app reads each API key from an env-var—such as `TOKENTIDE_API_KEY` or `AI_GATEWAY_API_KEY`—kept only in vercel (type **Secret**) and in `.env.local` on your computer. You paste keys there yourself; you never paste an API key into the chat, into your code, or onto GitHub.

All API calls that use a secret key happen strictly on the server (in Next.js Server Actions or Route Handlers), never in the visitor's browser. If a key ever leaks, you revoke it immediately on the provider's website, create a new one, and update Vercel and `.env.local`.

## In your project

When your plan reaches an AI feature, your agent prepares `.env.local` with empty `TOKENTIDE_API_KEY=` and `AI_GATEWAY_API_KEY=` lines and guides you to paste your keys in VS Code and in Vercel Settings. Then it runs `npm run check-env`, which checks only whether each variable name is set or missing—never printing the secret value.

## Copy for your agent

```text
Check which external APIs my project uses, confirm all API calls run strictly on the server, and run a check that shows only whether their environment variable names are set or missing.
```

---
Source: [Agentic Makers](https://agenticmakers.app/en/learn/what-is-an-api) · License: CC BY 4.0