How are API keys managed?

API keys are stored in a secret manager, environment variables, or equivalent systems, kept separate from the code with limited access. Where possible, we use different keys per environment, minimal permissions, rotation, and revocation. Logs must avoid exposing the full value of credentials.