One key per surface. Create bearer keys in the console — one for your laptop, one for CI, one per customer. A key is shown once; only a hash is stored, so a lost key is replaced, never recovered.
Budgets bound the blast radius. Give each key a credit cap. A script in a retry loop can burn a balance in minutes; a cap stops the next request before it runs, not after.
Scopes narrow what a key can do. infer runs models, models:read lists them, usage:read reads balance and history. A read-only dashboard key never needs inference rights.
Teams share one pool. Create a team, invite members by email, and keys scoped to the team draw from the shared balance. Owners see every credit in the ledger.
Rotate and revoke instantly. Rotating issues a new secret while keeping the key's budget, scopes and history. Revoking stops the next request; past usage and the audit trail stay on the record.