- **Don't share it** over chat, unencrypted email, or paste it anywhere public. - **Don't upload it to a code repository** (not even a private one): use environment variables or a secrets manager. - **One descriptive name per integration**, don't reuse the same key for everything — that way, if something goes wrong, you only revoke the affected one without cutting off the rest. - **Rotate long-lived keys periodically** (revoke + create, section 9), especially company ones, which act as admin. - **Revoke immediately** any key you suspect leaked — there's no "pause", only permanent revocation.