BuildAPI vs a plain API key
A plain API key is a random string and a lookup that says it exists. Here is what that leaves out, and what a BuildAPI key does instead.
Often stored as written, so anyone who can read the table can use every key in it.
Matched on a peppered hash. A server key's value is shown once, when it is made, and never stored.
Anywhere it is pasted. A copied key works for whoever copied it.
Only for your domain. Optionally only from listed IP addresses (a blocked address stays blocked even inside an allowed range) and only from the countries you choose. IP allowlists: from the Professional plan.Country rules (geo-blocking): from the Professional plan.
Everything the account can.
Only its scopes. A client key, the one published in your pages, cannot read security data; that takes a server key. Custom scopes: from the Professional plan.
When somebody remembers to delete it.
On its expiry date, or when you revoke it. You can also suspend a key and resume it later; a suspended key answers with its own reason, so your integration can tell paused from gone.
The new key breaks every deployment of the old one at the same moment.
Rotation keeps the old value working for a grace window while you deploy the new one, and emails you when it happens.
Without limit, until the bill or the outage shows it.
A monthly allowance counted over your own billing cycle, plus an optional per-minute limit on each key. Calls refused for being over a limit are not charged against it.
Whatever your server logs happen to keep.
Every call is logged with its result, the reason for any refusal, and the address it came from, or only its network if you ask for that.
Nobody is watching.
You are emailed when a key is refused again and again from a domain or country you do not use, or suddenly carries far more traffic than usual.
When a plain key is enough
If the key never leaves servers you control, only your own scripts call it, and one person would notice if it leaked, a random string checked against a hashed table may be all you need. BuildAPI earns its place when the key has to live somewhere you do not control: in your customers' pages, on their servers, or in software you ship.