API Key Security

Best practices for API and agent key management.

Store keys in environment variables or a secrets manager — never in source control
Never put API keys or agent keys in URLs, query parameters, or client-side code
Use separate keys per environment (development, staging, production)
Rotate keys by creating a new key, updating applications, then revoking the old key
Use scoped permissions with minimum required access
Enable IP restrictions for server-side integrations
Use agent keys to bind runtime requests to specific agent identities