Create keys in Developer tools. Vantage shows the full key once. Store it in a server-side secret manager and never expose it to browsers, mobile apps, logs, or source control.

​
Scopes

Use the smallest set needed. Add an expiry and IP or CIDR allowlist where your egress addresses are stable.

​
Key state

A key stops working when it expires, is revoked, its creator is disabled or moved, or its institution becomes inactive. Revocation takes effect immediately.

​
Rotation

  1. Create a replacement with the same or narrower access.
  2. Update callers and confirm the new key’s last_used_at.
  3. Revoke the old key.