API Keys

Separate Keys by Environment

Use dedicated keys for development, staging, and production.

Naming Convention

• Include service name and environment, e.g. api-gateway-prod.
• Avoid generic names like test1 or key-new.
• Add ownership tag in internal docs.

Monitoring

Use API Management page to monitor per-key call volume and last-used timestamp.

1. Review inactive keys weekly.
2. Delete unused keys to reduce risk.
3. Alert on unusual traffic spikes.

Production Readiness

• Pin SDK/API versions in deployment manifests and release notes.
• Record request_id/job_id in logs for every API interaction.
• Run smoke tests after each deploy using a known short test video.
• Separate dev/staging/prod keys and rotate keys regularly.

Acceptance Checklist

1. Validate one success path and one failure path end-to-end.
2. Confirm credits, usage metrics, and output links are consistent.
3. Set retry and timeout policy for 429/5xx response handling.
4. Document rollback procedure for integration incidents.

Key Governance Model