Authentication
Separate access for every scope.
Production credentials, scopes and rotation rules must be defined with the relevant service. This documentation provides no production secrets.
Least-privilege access
Separate read and write access, assign rights by need and remove unused access. Keep secrets in a dedicated server-side manager.
Revocation and audit
Define who can create and revoke keys, then log changes without recording the secret itself. Sandbox examples do not create production permissions.