LexelaneA practical API key checklist for small teams
Keep credentials private while making usage easier to understand.
Separate applications and environments
Create different keys for development, staging, and production. Use recognizable names and a budget appropriate for each application. This makes unexpected spending easier to isolate.
Store the secret once, securely
The full secret appears only at creation. Store it in a secret manager or private environment configuration. The dashboard retains a prefix and server-side hash, not a recoverable copy.
Revoke exposed keys immediately
If a key appears in a screenshot, log, repository, or browser bundle, revoke it and create another. Review request records and the billing ledger. Removing a leaked value from a file does not make the old credential safe again.
Use budgets and expiry together
A spending cap limits monetary exposure; an expiry limits the lifetime of access. Neither replaces monitoring. Check Usage and remove credentials for projects you no longer run.