Creating and protecting API keys

Create a separate key for each application or environment and grant only the scopes that workflow needs. Never place a key in browser code, a public repository, a support ticket or a client-side log. Store it in a managed secret store and pass it through an environment variable. Rotate a key when a team member leaves, a secret may have been exposed, or an integration changes ownership. Revoke a key immediately when it is no longer needed. The key list shows lifecycle and last-use information; it does not display an existing secret again. Use the sandbox key for evaluation where available. Keep production keys for approved workloads and monitor usage from the customer portal.