A restricted key is an API credential that is intentionally limited to specific resources, endpoints, or actions. Instead of granting full account access, it may allow only read-only access, a single service, or a narrow set of operations such as listing objects or creating one type of record. This makes it different from a broad secret key, which can often act like a password for the whole integration.
Restricted keys matter because exposed credentials are a common attack path. If an attacker steals a limited key, the damage is smaller: they may be unable to change billing details, export all data, or administer the account. Defenders use restricted keys to reduce blast radius, especially for third-party integrations, internal tools, and automation. They are often paired with IP allowlists, short lifetimes, and secret rotation so that a leak does not become full control.