Keys with clear boundaries

Choose the smallest useful scope

A scope pairs a project and action: currency:latest permits only that action. currency:* grants every action in that project, including future additions, so use it only when necessary. Scopes do not bypass activation, balance checks or account restrictions.

x-api-key: <server-side-secret>
Idempotency-Key: <stable-unique-request-id>
Content-Type: application/json

Create once, store securely

1. Give the key a purpose-specific name, such as “expense-service”.
2. Select explicit operation scopes and create the key from your signed-in workspace.
3. Copy the secret into a server-side secrets store. After dismissal it is no longer displayed.
4. Rotate by creating a new key, updating your server and revoking the old one. Revocation is not reversible.

Session writes stay on the same origin

The web application sends JSON writes to relative /api routes using same-origin credentials. The server validates Origin for session-backed writes. Never loosen that check to make a cross-origin client work; server API-key calls have a separate authentication path.