The term "API key" is overloaded for two very different meanings. In your case, it's not entirely clear, but from
when one website's API logins to another website's API automatically
(emphasis mine) I gather that you're talking about logging in from the server side, in which case Maximillian's and Stephen's answers are right.
However there's also another, possibly older and arguably more common definition of "API key", where it's not a key at all, because it's not secret. This is what Nat seems to be talking about.
For example, if you wanted to access some third party's web-based API from the client side of your web application, or from an application running on the user's PC or phone, any "key" is something you ship to the user, which they're able to reuse for any purpose they like, not just the purpose you intended. This "API key" may be used for access only to unprivileged interfaces (think Google Maps) or may be accompanied by a login specific to the user (not to your application) with the API provider.
Why have this sort of "API key" at all if it can't have any secrecy and provides no meaningful access control? I have a Twitter thread on the topic where I described it as "low-grade accountability in a walled garden". Basically, the API provider is making anyone who wants to integrate with their service get an identifier so that all use associated with their application can be tracked, monitored for misuse, and cut off if the API provider suddenly decides they don't like what the application is doing. Yes, a skilled person can extract the identifier from an application and use it for their own purposes, but the scale of this is expected to be limited; if they ship an application with someone else's API key, there is clear public evidence they did so, and they're likely to face legal problems.
Unfortunately, this has two really bad side effects:
Calling it a "key" is extremely confusing to programmers using the API, especially when you're telling them to embed it in their client-side application code. This leads directly to programmers putting actual credentials (the other kind of "API key") in their client-side code because they don't understand the difference.
Since API providers insist application developers keep their keys private, despite that being impossible, and only use them for one application, it locks out open source applications from shipping source in a form where it builds and works "out of the box" without the user having to obtain their own key.