An owner's guide to API keys

The keys you did not know you had

Four rules that prevent most problems

The hygiene fits on a card:

• Know where they live: keys belong in a proper secrets store or a locked-down file, never in emails, chat threads, or shared docs
• Own the accounts: every key should be issued from accounts your business controls, so a departing vendor cannot walk off with access
• Least power per key: a key that only reads cannot be tricked into spending, ask whether each key can do more than its job requires
• Know how to revoke: every key can be cancelled in minutes from the issuing account, and someone in your business should know how

Questions for whoever builds for you

You do not need to audit the code. Ask three questions instead: whose accounts issue the keys, where are they stored, and what happens if we part ways. A builder with good answers has thought about your independence. A builder who waves them off is building you a dependency.

The answers we give are on record: your accounts, your store, and nothing breaks if we leave.

The mindset

Treat keys like signing authority, because that is what they are. Granted deliberately, scoped narrowly, listed somewhere the owner can see, revoked without drama. A business that holds its keys this way can adopt automation aggressively, because it can always change its mind.