What an API key is, and why AI tools ask for yours

What an API is

API stands for application programming interface. The name is much worse than the idea.

Think of a supplier with a shop at the front and a trade counter at the back. The shop is the chat app you already know: ChatGPT, Claude or Gemini in a browser tab, where you type and read. The trade counter is the API. Other businesses’ software orders the same goods there, in a fixed format, on account. No person types into a chat window. A program hands in a request, the model writes an answer, and the answer goes back to the program.

Same models, same company, different door. When the Grader sends your prompt to Claude, it goes through that trade counter. So does every customer-service bot, writing assistant and spreadsheet add-on that has a model inside.

What the key does

Every order at a trade counter has to say whose account it goes on. That is the job of an API key: a long string of letters and numbers that the provider issues to your account. Anthropic’s keys start with sk-ant-, Google’s with AIza, OpenRouter’s with sk-or-. Any software holding the key can place orders on your account, and you pay for them.

Two things follow from that.

• A key behaves like a card number. Anyone who has it can run up charges without knowing your password. Guard it the same way.
• You can have many keys. One account can hold a dozen keys, each with its own name, and you can cancel any one of them without touching the rest.

Your account password and your API keys are separate things. The password gets you into the provider’s website. A key lets a program use the models. Changing one leaves the other as it was.

Why tools ask for your key

A tool could use its own key, pay the provider itself and charge you a subscription. Plenty of tools do. thinkhard.si asks for yours instead, and the reasons mostly work in your favor:

• You pay the provider directly, at cost. No markup, no subscription, no minimum. Run ten prompts this month and you pay for ten prompts, at the provider’s list price.
• Nothing goes through us. Your browser sends the prompt straight to the provider with your key. thinkhard.si has no server in the middle, so we never see your prompts, the answers or the key.
• You choose the model. Any provider you hold a key for, any model it offers, including fast cheap ones and free ones. Nobody picks a model for you because it suits their margins.
• The controls stay with you. Spending limits, usage reports and the button that cancels a key all live in your provider account.

The cost of this setup is about five minutes of signing up, and the fact that keeping the key safe is partly your job. The rest of this guide covers both.

Your chat plan does not cover it

This catches a lot of people. A paid chat plan such as ChatGPT Plus or Claude Pro pays for the chat app. API use is billed separately, on a different billing page, even when it is the same company and the same email address. OpenAI states this in its billing help for ChatGPT and the API, and Anthropic has a help article on exactly this question.

So if you already pay for a chat plan, expect a second, usually much smaller bill for API use. Or start with one of the free options below and decide later.

What it costs in practice

Providers charge by the amount of text, counted in tokens. A page of English is roughly 500 to 700 tokens. What you send is priced lower than what the model writes back, and prices are quoted per million tokens, which is why a single request usually costs a fraction of a cent.

Here are three ordinary jobs priced on four models. The token counts are assumptions for illustration, chosen to be on the generous side.

• 100 Grader runs. Each run examines a prompt, rewrites it and examines the rewrite: about 4,000 tokens sent and 3,000 written in total.
• A month of email drafts. 20 drafts a day for 22 working days, 440 in all. Each sends the thread and your notes (1,500 tokens) and gets back a draft (300 tokens).
• One Prompt Tester test. 3 versions of a prompt on 20 test cases, so 60 answers of 1,000 tokens sent and 400 written, plus 60 judge checks of 1,500 sent and 200 written.

The exact figures matter less than the pattern. For one person’s daily work, even a top model costs a few dollars a month, and a fast model costs pennies. Bills get large when software runs a prompt thousands of times a day, which is a different calculation, covered in what an LLM call really costs.

Free ways to start

Three providers offer a free tier that works with every thinkhard.si tool:

• Google AI Studio gives a free key for Gemini Flash models, within daily limits. You need a Google account. Read the catch before you use it: under the Gemini API terms, Google may use what you send on the free tier to improve its products, people may review it, and Google asks you not to submit sensitive, confidential or personal information. Paid use is treated differently; see Google’s pricing page.
• OpenRouter gives one key for hundreds of models from many companies, some of them free (their names end in :free). OpenRouter’s limits page allows 20 free requests a minute and 50 a day until you have bought $10 of credit, then 1,000 a day. Some of the companies behind free models may log prompts.
• Groq runs open models such as gpt-oss-120b very quickly and has a free plan with per-minute and per-day caps, listed on its rate limits page and in your Groq console.

Free tiers are fine for learning the tools and for prompts with nothing private in them. Expect to hit a rate limit now and then. For anything involving customers, staff or unpublished company information, use a paid key under business terms you have read. The risk checklist for AI at work explains why.

How to get a key

The screens differ by provider, but the order of steps is the same everywhere. Settings links straight to each provider’s key page.

1. Go to the developer site, not the chat app. For Claude that is the Claude Console, for GPT the OpenAI Platform, for Gemini Google AI Studio.
2. Sign in or create an account. You may be asked for an organization or project name. Your own name or your company’s is fine.
3. Add billing, or stay on the free tier. Many providers work on prepaid credit: you buy $5 or $10 up front, and requests stop when it runs out. Anthropic, for one, requires credit before the first API call.
4. Set a spending limit before you create the key. Look in the billing or limits page. If there is an automatic top-up, decide deliberately whether you want it on.
5. Create the key and name it after where it will live, such as “thinkhard.si, work laptop”. Copy it straight away. Many providers show the full key only once.
6. Paste it into Settings. Open Keys and data, paste the key into the row for that provider and press Save. The row checks the key with the provider and says “Key works” when it does.
7. Run something small, then open your provider’s usage page and look at what it cost. That one look will calibrate your sense of price better than any table.

Keeping a key safe

• Put a ceiling on it. A monthly spending limit, a prepaid balance with automatic top-up off, or both. If the key leaks, the damage stops at the ceiling.
• Use one key per tool. A separate key for each tool, and for each computer if you like, means you can cancel one without breaking the others, and the usage page shows which tool spent what.
• Never paste it where people can read it. That rules out emails, chat messages, shared documents, support tickets, screenshots and prompts. If a colleague needs access, they get their own key. OpenAI’s key safety guidance goes further and says sharing keys breaks its terms.
• Revoke first, investigate second. If a key may have leaked, delete it in the provider’s console and make a new one. It takes a minute. Then check the usage page for calls you did not make.
• Mind the browser. A key kept in a browser is only as safe as that browser. On a shared or public computer, switch Remember off so the key disappears with the tab, and be choosy about browser extensions, since some can read the pages you visit.
• Use a company account for company work. If the key will touch company data, create it on an account the business owns. Billing, data terms and offboarding then belong to the company, not to one employee’s card.

Where thinkhard.si keeps your key

Exactly here, and nowhere else:

• In your browser. With Remember on, which is the default, the key is saved in this browser’s local storage so it is there next time. With Remember off, it is kept only for the current tab and is gone when you close it.
• Sent only to its own provider. Your Anthropic key goes only to Anthropic, your Google key only to Google, over HTTPS, straight from your browser. thinkhard.si has no server that receives it.
• Left out of everything you share. Keys are never included in exports, share links or anything sent to thinkhard.si.
• Logged for you to see. Settings shows a log of every call made with your keys, so you can check what ran and when.
• Removable in one click. Forget all keys in Settings removes them from this browser. That does not cancel them at the provider. To cancel a key for good, delete it in the provider’s console.

When a key does not work

Error messages from providers are written for programmers. Here is what the common ones mean.

Related guides

• Choosing an AI model for businessWhich model to use your new key on, by task and by price.Ends in Model Compare
• What an LLM call really costsThe arithmetic behind the table above, for higher volumes.Ends in Tokens
• A risk checklist for AI at workWhat data belongs on which key, and what needs a person.Ends in the Chatbot Safety Test