Keep keys on your server
Do not expose API keys in browser code, mobile application packages, public repositories, or chat messages.
Secure use
Protect the key first
An API key can authorize requests to your account. Keep it out of browsers you do not control, public repositories, screenshots, and support messages.
Scope and rotate credentials
Separate keys by purpose, revoke unused credentials, and replace a key immediately when exposure is suspected.
Minimize sensitive input
Send only data needed for the task, removing unnecessary personal or confidential information before submission.