API keys

API keys identify calling clients and control permissions.

Key types

• Read-only keys for runtime services
• Write keys for CI/CD and admin tooling

Operational guidance

• Store keys in a secret manager
• Never commit keys to source control
• Rotate on a fixed schedule