An API key lets another system — the building management system (BMS) that runs the site's controls, a reporting tool, a script your own team wrote — read or write your organization's data without a person signing in. Each key is limited to what it's allowed to touch and can be revoked the moment it's no longer needed, without affecting any other key.
The key itself is shown once, at creation. If it's lost, the answer is to revoke it and create a new one — there's no way to look a key back up afterward, the same way a password can't be looked back up.
Treat a key the way you'd treat a password: anyone holding it can act as your organization within its limits. Hand it only to the person setting up the other system, keep it wherever your firm keeps its passwords, and never paste it into a spreadsheet, an email or a chat message.