Manage API credentials safely
Scope, store, and rotate API keys used by your application or agent runtime.
1. Issue a key for the integration
Create an API-workspace key with only the scopes the integration needs. Copy the reveal-once value into a secret manager and set an expiry when appropriate.
2. Keep secrets on the server
Send a key through the authorization header. Do not include it in a URL, browser bundle, agent prompt, or repository. Configure MCP clients through protected secret inputs or environment references.
3. Validate with a test credential
Use simulated test fixtures to verify request construction and error handling before attempting live work. Confirm the scopes for job reads, result reads, and exports separately.
4. Rotate and revoke
When rotating a key, configure the replacement in the integration and verify it works before revoking the previous key. If a key is exposed, revoke it promptly. Record request IDs for support, never secret values.