Storage and scope come first
Most API key incidents do not involve sophisticated attacks. A key gets committed to a repository, pasted into a support ticket, or left in a Slack channel, and automated scrapers find it within hours. Prevention starts with boring discipline.
Keep production keys out of client-side code, out of git history, and out of chat. Give every key the narrowest scope that works, and set spending limits where the provider allows it. A leaked read-only key is an annoyance. A leaked billing-enabled key is a very bad week.
Rotation and sharing routines
Treat every key as temporary. Rotate on a schedule, rotate immediately when a teammate leaves, and rotate after any suspected exposure. If rotation is painful, that is a sign keys are scattered across too many places.
For handoffs, never send raw keys through chat or email. Encrypt the key in the browser, share a short-lived link, and have the recipient confirm before the link self-destructs. Small teams rarely need enterprise secrets infrastructure to follow these habits consistently.