API Keys Explained: What They Are, Why Free Ones Exist, and How Not to Leak Yours

An API key is a password for your program. When an API gives you one, every call your app makes carries it, so the provider knows who is calling, can count your usage — and can cut you off if you abuse the free tier.

Why do free keys exist at all?

Because providers are businesses. The free tier is the shop window: generous enough to build and learn on, limited enough that a company with real traffic upgrades. That is why the honest directories (this one included) print the free limits on every listing — "free" with a 25-requests-per-day cap is a different animal from "free" with 10,000.

The three safety rules

• 1. A key in front-end code is public. Anything shipped to a browser can be read by anyone. For learning projects that is usually acceptable — for anything real, call key-gated APIs from a small backend and keep the key in an environment variable.
• 2. Never commit a key to GitHub. Bots scan new commits within seconds. Keys go in a .env file that is listed in .gitignore. If you leak one: revoke it first, feel bad later.
• 3. Respect the limit. Cache responses, debounce your search boxes, and do not poll a free API every second from a thousand users. Free tiers die when people abuse them — do not be the reason a good API leaves this directory.

Keyless vs free-key — which should you choose?

For learning and prototypes: keyless APIs, always — zero friction. For a project you will actually ship: a free-key API from a serious provider (NASA, TMDB, GitHub) is often more reliable, because the key means rate limits are per-user, not shared with the whole internet.

Every listing in our catalog states its auth honestly — No key, or Free key with the real limits. No surprises, by design.