Authenticate with modern standards, favoring OAuth scopes that grant only what is necessary. Separate machine identities from human logins and use short-lived tokens where possible. Document who owns each integration. Clear boundaries limit blast radius, simplify debugging, and make it painless to rotate credentials without stalling work or quietly granting more power than any single script should realistically ever hold.
Store API keys in a vault, never hard-coded, never pasted into chat threads. Enable automatic rotation and audit retrieval. Redact sensitive fields in logs, screenshots, and notifications. When sharing recipes, reference variables rather than values. By normalizing secrecy as routine craftsmanship rather than paranoia, you protect colleagues, customers, and your future self from late-night scrambles over leaked credentials and untraceable configuration drift.