Prefer scoped keys, named per integration, stored where humans do not screenshot them for “just this once.” Pair rotations with dashboards or logs verifying which client still screams 401—we have all heard that aria. For broader cheat sheets on common web mistakes, skim OWASP Top 10 awareness without turning it into competitive bingo.