A restricted API key is a limited-permission credential used to authenticate requests while allowing only specific actions, resources, or endpoints. It is designed to reduce blast radius: if the key is exposed, the attacker should not inherit full control of the account or service.
In cyber security, restricted keys matter because API secrets are often leaked through code repositories, build logs, configuration files, or misconfigured automation. Attackers look for these easy trust boundaries because a valid key can bypass normal login controls. Defenders use restricted keys as part of least-privilege design, but they are not a complete fix. They still need secure storage, monitoring, rapid rotation, and revocation when exposure is suspected.