API Key Security Checklist

Use a separate key for each major app or environment (dev, test, prod).
Store keys in a password manager or secure secrets vault (not in plain text files).
Prefer environment variables or encrypted config files for scripts and apps.
Never hard‑code keys directly into source code, especially in public repos.
Do not embed keys in client‑side code (browser JavaScript, shared binaries, etc.).
Limit access to people and systems that actually need the key.
Rotate/regenerate keys on a regular schedule or after any suspected exposure.
Immediately revoke any key you believe might have been leaked.
Keep a simple log of where each key is used (which machines, scripts, or apps).
Review your provider’s usage dashboard periodically for unusual activity.