API keys done right

An API key is a bearer secret: whoever holds the string is the client, no questions asked. That bluntness is why scope and storage matter more than the key itself. A key minted with full account access, pasted into a step parameter, and shared across three flows is a single point of catastrophic failure — leak it once and an attacker can read every record, run up spend, and you cannot even tell which flow was breached. Treat every key as a liability sized to exactly what one integration needs, and nothing broader.

Scope down at the source: most providers let you mint a key restricted to specific endpoints, read-only where possible, and rate-limited per key. In the engine, store it as a Connection — never a literal in an HTTP Request field, where it lands in the exported flow JSON and the run history. Reference it through the Connection so the value is encrypted at rest and masked in exports. Give each flow, or each environment, its own key so you can revoke one without breaking the others.

Where it breaks: rotation you never planned for. A key with no expiry and no owner outlives the person who created it, gets copied into a Postman collection and a Slack thread, and becomes impossible to retire safely because nobody knows what would break. Rotate on a schedule, keep the old and new key valid during an overlap window, and cut over cleanly before you revoke.