What is an LLM API key? It is a long secret string that a model lab gives you so your own code can call its large language models directly. Every request your app sends to the OpenAI API, the Anthropic API, the Gemini API in Google AI Studio or the xAI API carries that key, and the lab uses it to work out who is calling, which project to bill and which limits apply. Treat it like a password: anyone who has it can spend your money.

Below: what the key does at each of the four big frontier labs, why a chat subscription is not an API key, what one API call looks like, and the safety rules the labs publish. Facts come from the labs' own docs, checked October 14, 2026.

What an LLM API key actually is

OpenAI's help center describes an API key as a unique code that identifies your requests to the API, meant to be used by you. Google's Gemini docs add the part that matters for your wallet: every Gemini API key belongs to a Google Cloud project, and that project handles billing, collaborators and permissions. Google says plainly that keys have no billing settings of their own. They inherit the tier, limits and billing status of the project they live in.

So an LLM API key does three jobs at once:

  1. Identity. It tells the lab which account (and, on some platforms, which person or service) is making the call.
  2. Billing. Usage on the key is charged to the project, organization or team the key belongs to.
  3. Limits. Rate limits and spend caps attached to that project or tier apply to every request made with it.

It is not a login for the chat app. It goes into code, a terminal, or a developer tool that asks for it.

API key vs chat subscription

The most common mix-up: a paid chat plan and an API key are separate products with separate bills.

  • OpenAI: its help center says ChatGPT and the API platform have separate billing systems, and API usage is billed separately from your ChatGPT subscription. ChatGPT Plus or Pro does not give you API credit.
  • Anthropic: Claude's help center says a paid Claude plan enhances the chat experience and the Claude API is billed separately through the Claude Console. One twist: Claude Max and Team plans now include monthly API credits that you claim by linking a Console organization. Anthropic's docs list $100 a month for Max 5x, $200 for Max 20x, and up to $500 pooled for Team. Free, Pro and Enterprise plans are not eligible, and the credits expire each cycle with no rollover.
  • Google: the Gemini API has its own Free tier in AI Studio and its own paid tiers. Moving to paid means linking a Cloud Billing account and, for most new users, prepaying at least $5 of credit. Google also notes that the $300 Google Cloud welcome credit cannot be used for Gemini API usage on accounts opened after March 2, 2026.
  • SpaceXSI (xAI): Grok API usage is billed per token from prepaid team credits in the Console, with monthly invoicing available on request. With the default $0 invoiced billing limit, requests are rejected once prepaid credits run out.

If you want to compare chat subscriptions instead, see ChatGPT Plus vs Claude Pro vs Google AI Pro.

LLM API keys at each frontier lab

LabWhere you create the keyEnvironment variable the SDKs readHow the key is sentHow usage is paid
OpenAIAPI keys page in the OpenAI dashboardOPENAI_API_KEYAuthorization: Bearer headerSeparate API billing, prepaid credits
AnthropicClaude Console, Account SettingsANTHROPIC_API_KEYx-api-key header or Authorization: BearerConsole prepaid credits or invoicing; Max/Team monthly credits
GoogleAPI Keys page in Google AI StudioGEMINI_API_KEY or GOOGLE_API_KEYx-goog-api-key headerFree tier, then Cloud Billing (Prepay or Postpay)
SpaceXSI (xAI)API Keys page at console.x.aiXAI_API_KEYAuthorization: Bearer headerPrepaid team credits or monthly invoicing

In words: OpenAI and xAI both expect the key as a bearer token, and xAI's API accepts OpenAI's SDKs if you point them at its own base URL. Anthropic accepts a bearer token or its older x-api-key header, and every request also carries an API version header. Google's Gemini API reads the key from an x-goog-api-key header, and its client libraries pick up GEMINI_API_KEY or GOOGLE_API_KEY automatically, with GOOGLE_API_KEY winning if both are set.

OpenAI

You create a key in the API dashboard and export it as OPENAI_API_KEY; OpenAI's quickstart notes that each official SDK reads the key from the environment automatically. Project keys can have an expiration date, and administrators can enforce a maximum key lifetime for the whole organization or a project. For supported cloud workloads, OpenAI now recommends workload identity federation, which swaps a trusted cloud identity for a short-lived OpenAI token so you never store a long-lived key at all.

Pros: expiring project keys, per-key permissions, IP allowlisting, hard spend limits.
Cons: keys cannot be shared between people (OpenAI says sharing is against its Terms of Use), so teams must invite members instead.

Anthropic

Anthropic's API overview says you get keys in the Claude Console after trying requests in the playground. You pick each key's type and expiration when you create it, and Anthropic suggests workspaces to separate environments and control spend by use case. Like OpenAI, Anthropic also supports Workload Identity Federation as an alternative to a stored key.

Pros: expirations at creation time, workspaces with their own spend limits, Max/Team credits for hobby building.
Cons: a multi-workspace key needs an extra workspace header, which trips up first-time setups.

Google (Gemini API)

New users get a default Cloud project and API key created automatically after accepting the AI Studio terms. Google is moving everyone to authorization keys: since May 28, 2026, every new key made in AI Studio is an auth key bound to a service account, restricted to the Gemini API by default, with faster shutdown of leaked keys. The Gemini API rejects unrestricted standard keys, and from May 7, 2026 it also blocks unrestricted keys that have sat dormant for a long time.

Pros: a genuine Free tier, auth keys that are locked to the Gemini API by default.
Cons: older unrestricted keys stop working until you restrict or replace them; on Prepay, a $0 balance stops every key on that billing account at once.

SpaceXSI (xAI)

The Grok API quickstart is three steps: sign up at console.x.ai and add credits, create a key on the API Keys page, and export it as XAI_API_KEY. Every Console account also includes a free Playground for testing before you pay. The flagship grok-4.7 is listed at $2 per million input tokens and $6 per million output tokens.

Pros: OpenAI-compatible endpoint, so existing code ports quickly.
Cons: no free production token pool; API credits are non-refundable per SpaceXSI's FAQ.

For which labs offer genuinely free usage on a key, see our guide to free OpenAI API alternatives.

What is an LLM API call?

An LLM API call is one HTTPS request from your code to the lab's server: your key, the model name and your input go out, and the model's answer comes back as JSON. Here is the shape of a minimal call to OpenAI's Responses API, with the key read from your environment rather than pasted in:

curl https://api.openai.com/v1/responses \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-6-astra", "input": "Explain an API key in one sentence."}'

You pay per token, not per call. Anthropic's sample response shows a usage block with input and output token counts for each message, and Google lists input tokens, output tokens, cached tokens and cache storage time as what the Gemini API bills for. Google also notes that a request failing with a 400 or 500 error is not charged, though it still counts against your quota. Cheaper models change the math a lot; our Claude Haiku 5.5 vs GPT-6 Luna guide compares two budget options.

How to use an LLM API key safely

The labs agree on the core rules, and these come straight from OpenAI's key-safety guide and Google's Gemini key docs:

  1. Keep it on a server. Never put a key in a web page or mobile app. Both OpenAI and Google warn that client-side keys can be extracted; route requests through your own backend.
  2. Never commit it to Git. OpenAI calls committed keys a common way credentials leak, even from private repositories.
  3. Use environment variables, and in production a secret manager such as Google Cloud Secret Manager or another key management service.
  4. One key per person or service. Invite teammates rather than sharing a key.
  5. Set expirations and rotate. Create the replacement, deploy it, confirm it works, then revoke the old one.
  6. Cap the damage. OpenAI notes that spend alerts alone do not stop traffic; turn on hard spend limits. Google suggests billing alerts, and Anthropic workspaces can each carry a spend limit.
  7. Restrict where it works. OpenAI offers IP allowlisting, and Google lets you restrict a key by IP address and to the Gemini API only.

If your key leaks

Google's leak checklist is a good universal order: make a new key, update your app to use it, disable the compromised key once the new one is live, then audit your usage and billing for anything you did not run. OpenAI says to rotate a leaked key immediately from the API Keys page and contact support if you see misuse.

Pros and cons of using an LLM API key directly

Pros

  • Pick the exact model and settings instead of whatever the chat app defaults to.
  • Pay only for the tokens you use, with no monthly seat fee.
  • Build the model into your own product, scripts or workflows.

Cons

  • You are responsible for security; a leaked key is a billing problem.
  • Costs scale with use, so a runaway loop can drain credits fast.
  • You lose the chat app's built-in extras unless you rebuild them.

If you only want to chat with the best assistant, you probably do not need a key at all; start with ChatGPT vs Claude vs Gemini vs Grok or try Gemini in the browser.

From Ahzy Capital (our own products, labeled as such): Get the free AI Agent Cheat Sheet: 24 copy-paste AI agent setups for 8 types of small business, with prompts and workflows. We make and sell these, so they aren't independent picks.

FAQ

Is an LLM API key free?

The key itself is just a credential; what costs money is the usage billed to it. Google's Gemini API has a Free tier with rate limits; OpenAI, Anthropic and SpaceXSI bill usage against credits or invoices. Claude Max and Team subscribers get monthly API credits included.

Does ChatGPT Plus come with an OpenAI API key?

No. OpenAI says ChatGPT and the API platform have separate billing systems, and API usage is billed separately from any ChatGPT subscription.

How do I use an LLM API key?

Create the key in the lab's console, save it as an environment variable such as OPENAI_API_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY or XAI_API_KEY, install the lab's SDK, and make a request naming a model. The SDK reads the key from the environment for you.

What is an LLM API call?

It is one request from your code to the model's server containing your key, the model name and your input. The response holds the model's output, and you are billed by the tokens going in and out.

Can I put my API key in a website or mobile app?

No. OpenAI and Google both warn that keys shipped in browser or mobile code can be extracted and used by anyone. Keep the key on a backend server and have your app call that server.

What should I do if my API key leaks?

Create a replacement key, switch your app to it, then disable or revoke the leaked key and review your usage and billing for activity you did not make. Contact the lab's support if you find misuse.

Sources