Skip to main content
To keep your account and services secure, and to reduce the risk of API keys being accidentally exposed or misused during storage, configuration, and use, we recommend that you review your key usage regularly and take the following measures:
  • Store API keys securely. Do not put API keys directly in startup commands, commit them to code repositories, or write them to logs. Do not show full keys in public documents, screenshots, or other shared content.
  • Use a separate API key for each environment and service instead of sharing one key, so each key can be rotated or disabled on its own.
  • Configure a network access policy for your API keys so that only trusted sources can use them. See Network Access for API Keys.
  • Rotate the API keys you use regularly, and delete keys you no longer need.

​
How to rotate an API key

  1. Go to Key Management in the console and create a new API key.
  2. Replace the old key with the new one in your applications and services, and verify that calls succeed.
  3. After confirming that every application and service that used the old key has been updated, delete the old key.
If you suspect an API key has been leaked, delete it immediately, then create and configure a new key. Applications and services still using the deleted key will no longer be able to make calls, so update their configuration at the same time.
If you need help, feel free to contact us. Thank you for your understanding and cooperation. Released on November 3, 2026 (UTC).
Last modified on November 3, 2026