A client-key is an authorization token a service uses to identify a trusted client device or app. It is not a password in the usual sense; it is often a short-lived or device-bound credential that lets a requester prove it has passed an earlier trust check, such as pairing, login, or a PIN-gated approval step.
In cyber security, client-keys matter because they often unlock privileged APIs or internal service layers. If an attacker can steal, guess, replay, or obtain one without the expected approval flow, they may act as a trusted client and reach functions that were meant to be protected. Defenders should treat these tokens as sensitive secrets, bind them tightly to the right device and session, and ensure they cannot be reused outside their intended scope.