API key management

One key, one job

Treat a key as an independently revocable unit of purpose, not as an account password. The useful granularity is environment × workload:

web-prod          production web app
web-staging       pre-production
batch-etl         nightly batch jobs
partner-acme      temporary partner key (with an expiry)
local-alice       a developer's machine

You get: one key to revoke per incident, usage reports split by workload for free, and external keys that can carry their own model list and expiry.

What each key can carry

Rotation

1. Create the new key with a dated name (web-prod-2026q3).
2. Update the secret manager and roll services.
3. Confirm on the usage page that traffic moved and the old key is at zero.
4. Disable the old key, wait 24 hours, then delete it.

Working as a team

• Never paste keys into chat. Share access to the secret manager, not the secret.
• When someone leaves, revoke their personal keys (local-*) and leave production untouched.
• Log the key name (never the value) at service start-up so incidents immediately show which key was in use.

Related

• Get an API key — creation and storage.
• Usage — spend per key.