API key

A password is for you, typed into a login box. A key is for your software, stored where only your app can read it, same idea, except nobody types this one.

Your own tool holds one key to read your store, and another for anything you later add that calls an AI by itself. Each one can spend money and reach real data.

Two rules, not negotiable: a key never goes in a chat message, and never into a file you save into version history. If one gets out, rotate it, create a new key, delete the old one, and the leaked one stops working. Keys belong in an environment variable.