API key security

An API key represents request authority and available balance. Treat it like a password, not an ordinary configuration string.

Use separate keys

• Use different keys for development, tests, production, and unrelated clients.
• Give each key a recognizable application name.
• Disable or delete keys that are no longer needed.

Store keys safely

• Use server-side environment variables or a managed secret store.
• Do not put long-lived keys in browser pages, extensions, or public repositories.
• Log a key name or small suffix only; never log the full value.

Set usage controls

Set appropriate boundaries for automation and tests. Monitor unexpected concurrency and consumption instead of letting development work share unrestricted credentials with production traffic.

If a key may be exposed

1. Disable or delete the affected key in the console.
2. Create a replacement key and update the affected application.
3. Review usage for the exposure period.
4. Check repositories, CI logs, screenshots, and collaboration tools for leftovers.