API
API authentication
Use scoped API keys and server-side credentials safely.
Keys
Create separate keys for applications and environments. Give each key only the scopes it needs.
Never expose secrets
Browser and extension clients should use account authentication or a server-side exchange; permanent API secrets must not be shipped to public JavaScript.