Credentials and integrations
Scope API credentials
Give API keys and tokens a narrow audience, permission set, lifetime, owner, storage location, and revocation path.
8 minute lesson
An API key is a bearer credential unless the protocol adds stronger proof. Anyone who obtains it may use its authority.
Create separate credentials per environment and integration. Scope permissions, avoid URLs and browser code, store only where needed, and log an identifier rather than the secret. Make rotation and revocation routine.
A shared production key used by billing and analytics makes revocation an outage for both. Separate credentials add inventory work, but they make ownership and blast radius visible.
Usage evidence should identify the credential without recording its value. A last-used timestamp and expected source help responders distinguish an abandoned key from one still serving production.
Replace one shared key with two scoped credentials and record their owners and permissions. Revoke the analytics key, then prove billing still works and analytics receives a denied response.
Lesson completed