Identify where the key is needed
Use credentials only in the authorized integration path described by the provider. An order report generally needs identifiers, targets, quantities, and charges, not the credential used to submit them. Do not copy a full request into a shared document without reviewing sensitive fields.
Limit operational exposure
Store credentials in the configured secret-handling mechanism for the application. Avoid embedding them in public pages, browser-visible code, or exported spreadsheets. If the provider supports permissions or restrictions, use the documented options appropriate to the task.
Plan credential changes
Keep the integration owner and update process documented. When replacing a key, verify the new authorized connection without exposing the value in logs. Reconcile in-flight purchases carefully so an authentication interruption does not trigger duplicate submission attempts.
Decision checklist
| Decision | What to check |
|---|---|
| Use | Authorized integration only |
| Reports | No secret fields |
| Change | Documented owner and process |
Worked example
A hypothetical support screenshot includes a request body with an API key. The useful evidence is the order reference and error context; the key should be removed before sharing. Exposing it does not help explain the customer's purchased quantity.
Example figures explain the decision; they are not current prices or promised results.