Custody best practices

• Don’t share it over chat, unencrypted email, or paste it anywhere public.
• Don’t upload it to a code repository (not even a private one): use environment variables or a secrets manager.
• One descriptive name per integration, don’t reuse the same key for everything — that way, if something goes wrong, you only revoke the affected one without cutting off the rest.
• Rotate long-lived keys periodically (revoke + create, section 9), especially company ones, which act as admin.
• Revoke immediately any key you suspect leaked — there’s no “pause”, only permanent revocation.