How does an API key work?
The service generates a long random key and links it to your account. Your program sends it with each request, usually in a header such as Authorization or X-API-Key, and the service looks it up to decide what the request may do and which quota or bill it counts against.
Because a key identifies a program, not a person, Google Cloud notes that its standard API keys associate requests with a project for billing and quotas but don’t authenticate a principal. Services that need to know which person is acting use OAuth or a sign-in session instead.
OWASP advises keeping keys out of URLs, where they can end up in web server logs, and not relying on API keys alone to protect sensitive resources. A key in front-end code is visible to every visitor, so secret keys belong in server-side configuration, with one key for each tool so you can revoke one without breaking the rest.
Why do API keys matter for a website voice agent?
A website voice agent needs two different credentials. The widget needs an identifier that says which agent to load, and it has to be public, because every visitor can read your page source. Your management tools need a real secret to change the agent, read transcripts or approve knowledge. Putting a secret key in embed code would hand that control to anyone who opens the page.
Voice also runs on paid AI models, and their API keys must stay on a server. A widget that asked you to paste a model provider’s key into page code would let any visitor spend on that account.
How Kawl Now handles API keys
Kawl Now’s embed holds only your public workspace ID, which starts with hl_. It tells the widget which workspace to load and isn’t a secret. Browsers can start calls with it only from the website origins you allow. That check relies on the Origin header, which a script outside a browser can set, and there’s no bot protection yet, so keep customer calls off until you’re ready.
The secret is the workspace token, which works as the API key for the REST API and the MCP server. Tokens start with hl_sk_ and are shown once, when you create them under Developers in the dashboard or with POST /api/manage/keys. Only a SHA-256 hash and the first 14 characters are stored, so a lost token can’t be shown again.
Each token can manage almost everything in one workspace, including settings, approvals, transcripts and other tokens. Verifying a team phone number for human handover, an early release, needs the signed-in dashboard instead. There are no read-only or scoped tokens, and tokens don’t expire, so revoke any you stop using under Active tokens or with DELETE /api/manage/keys/{id}. Creating or revoking a token emails the workspace owner.
Keys for OpenAI and the other services Kawl Now uses stay on its servers and never reach the browser.
Common questions
Is an API key the same as a password?
They’re both secrets, but an API key is for a program rather than a person. It works without a second factor and often lasts until it’s revoked, so keep it out of code you commit and store it where only the program can read it.
Where should you store an API key?
In server-side configuration, such as an environment variable or a secrets manager, readable only by the code that needs it. Never put a secret key in front-end code, a URL or a file you commit.