Definition
An API key is a string of characters that a client sends along with each request to identify itself to an API. Unlike OAuth tokens, API keys are typically long-lived, unscoped at the user level, and tied to a project or account rather than an individual user's data. They are the simplest authentication mechanism possible - just a shared secret you include in a header or query parameter.
API keys are suited for server-to-server calls where the caller is a trusted system, not an end user. They are poorly suited for user-facing apps, because a leaked key has no granular revocation and no user scoping. Best practice is to rotate API keys regularly, restrict them by IP or referrer, and never commit them to source code.
How SheetLinkWP relates to API Key
SheetLink Forms issues each paid customer a license key in the format slkey_ followed by 32 hexadecimal characters. The plugin uses this key to activate premium features by calling the SheetLinkWP licensing API. The key identifies the customer's plan (Pro, Agency, Agency Plus) and current add-on purchases, and the plugin caches the entitlement response for 12 hours to tolerate offline deployments. Keys can be rotated on demand from the customer portal, and deactivating a site frees up one of the seat slots included with that plan.