An API key lets a system outside the product — a BMS, a reporting tool, a script your own team wrote — read or write your organization's data without a person signing in. Each key is scoped to what it's allowed to touch and can be revoked the moment it's no longer needed, without affecting any other key.
The key itself is shown once, at creation. If it's lost, the answer is to revoke it and create a new one — there's no way to look a key back up afterward, the same way a password can't be looked back up.
Treat a key the way you'd treat a password: anyone holding it can act as your organization within its scope, so it belongs in a secrets manager or an environment variable, never in a spreadsheet or a chat message.