A Secret text credential holding the provider's API key. It is only ever sent to the provider, in a request header, and is removed from anything else sent to the model. A local model usually needs no key.