One key per surface. Create bearer keys in the console — one for your laptop, one for CI, one per customer. A key is shown once; only a hash is stored, so a lost key is replaced, never recovered.
Budgets bound the blast radius. Give each key a credit cap. A script in a retry loop can burn a balance in minutes; a cap stops the next request before it runs, not after.
Teams share one pool. Create a team, invite members by email, and keys scoped to the team draw from the shared balance. Owners see every credit in the ledger.
Revoke instantly. Revoking stops the next request with that key. Past usage stays on the record for audit.