What each term means
An API key is a code an app uses when it contacts a service. For example, a weather app might send its key when requesting a forecast. The key identifies the app or project and, depending on the service, may also grant access.
An access token is a temporary pass that gives a user or app permission to do specific things, such as view account details. A secret is any private value that could be misused if exposed, including passwords, private API keys, and access tokens.
Keep private values private
Keep private keys and tokens out of public code, browser code, screenshots, and logs. Some services offer publishable keys for browser use; check the service’s guidance before sharing a key. Teams limit what each credential can do, store secrets securely, and replace exposed ones.