One key per environment — production, test, and one per integration you want to be able to switch
off on its own. A key shared between two systems is a key you cannot revoke without taking both
down.
The secret appears once
We store a hash, not the value — the same way a password is stored. Lose it, revoke and create
another.
This is deliberately inconvenient: a key that can be re-read in the dashboard at any time is a
key that leaks along with dashboard access.
If one leaked
Revoke first, investigate after. DELETE /v1/api-keys/{id} applies to the next call, with no
grace period.
Never put the key in browser code or a mobile app. It allows sending on behalf of every domain
you have verified, and anyone who opens the inspector will find it. Every call to Kourio leaves
from your server.
Where to keep it
An environment variable, never in the repository. If a key has already been committed, revoke it
— deleting the commit does not delete it from the history of everyone who already cloned. 
