API keys
Scoped, project-bound credentials for machines.
View as MarkdownOne key, one project, explicit scopes
A key cannot reach across projects. Grant only the scopes the integration uses: db.query.read, db.query.write, blob.read, blob.write, app.read, function.read and the rest.
One key per integration
Separate keys mean you can revoke one without breaking the others, and the audit log attributes each change to the system that made it.
Where a key must never go
A key in a browser bundle is a published secret. Browser clients get short-lived tickets instead. In CI, keep the key in the secret store and never pass it as a public build argument.
Billing gates writes
An inactive managed subscription blocks platform mutations, including through API keys and the CLI. Sign-in and read access remain available so you can resolve the billing problem.