How should a new key be created?
Give the key a name that identifies its owner and purpose, such as production-web or reporting-worker. Copy the secret into your secret store when it is shown.
How is a key maintained?
Monitor usage and last activity, keep allowed origins narrow, and review active keys on a regular schedule.
When should a key be revoked?
Revoke keys that are exposed, unused, replaced, or tied to retired services. Test the replacement before removing the old key.