API secrets
Use per-integration keys. Never hardcode secrets in client-side apps. Rotate and revoke leaked keys immediately.
- Store secrets in environment variables or secret managers.
- Create one key per integration/service.
- Use least privilege and separate personal vs shared scopes.