Secure storage, usage guidelines, and incident response for API Keys.
The full key is shown in plaintext only at creation time. It cannot be retrieved afterward. Always copy and securely store it immediately after creation.
Follow these principles strictly:
If a key is compromised, take the following steps immediately:
Key visibility
The full key is shown in plaintext only at creation time. It cannot be retrieved afterward. Always copy and securely store it immediately after creation.
Authorization scope
- Set the shortest practical expiration to minimize the risk window if a key is compromised.
- A key's capabilities never exceed those of its creator — resources the creator cannot access remain inaccessible to the key.
Secure storage
Follow these principles strictly:
- Do not share keys in plaintext via email or instant messaging
- Do not leave keys in command-line history (avoid pasting directly into shell commands)
- Do not commit keys to Git repositories
Best practices
| Recommendation | Details |
|---|---|
| Use environment variables or a secrets manager | e.g., Vault, KMS — avoid plaintext storage |
| Rotate regularly | Never leave a key unrotated indefinitely |
| Separate by environment | Use distinct keys for development, staging, and production |
Leak response
If a key is compromised, take the following steps immediately:
- Delete or disable the compromised key
- Create a new key and update all dependent configurations
- Contact your security team to assess the blast radius