Never share your API keys publicly or commit them to version control. Rotate keys immediately if compromised.
Loading…
Security Best Practices
Do
- Store keys in environment variables
- Use separate keys for test & production
- Set minimum required scopes
- Rotate keys every 90 days
- Monitor usage for anomalies
Don't
- Hardcode keys in source files
- Push keys to public repositories
- Share keys across team members
- Use production keys in development
- Grant broader scopes than needed