Best practice in API key use

• Never share them in emails, chats, screenshots, or public forums.
• Treat them like passwords — only share with trusted systems, never with people.
• Use access controls to limit who in your team can view or manage keys.

• Avoid embedding keys directly in your code or repositories.
• Use environment variables, secret managers (e.g., AWS Secrets Manager, Vault), or configuration files excluded from version control.
• Run automated scans to detect accidental exposure of keys in commits.

• Replace keys on a fixed schedule (e.g., every 60–90 days).
• Rotate keys immediately if a team member leaves or roles change.

• Delete any keys that are no longer in use.
• Regularly audit all keys and confirm they still have a valid purpose.
• Dormant or forgotten keys are common attack vectors.

• Review usage logs regularly to spot unusual activity. Watch for requests from unexpected IP addresses, geographies, or times.
• Set up alerts for suspicious activity, like high request volumes or new patterns.

• Use secure vaults, password managers, or encrypted storage solutions.
• Never keep keys in plain text files or spreadsheets.
• Limit local storage of keys on developer machines whenever possible.

Act quickly on compromise.

• If you suspect a key has leaked, revoke it immediately.
• Generate a new key and update all affected systems without delay.
• Investigate the cause of the compromise and take steps to prevent recurrence.