Treat every API key like a password: keep it in server settings or .env, never in JavaScript, screenshots or support tickets. Use separate keys for test and live, rotate keys when staff leave, and restrict keys to your server's IP where the provider allows it.
0 comments