API keys and service accounts

• A key does at most what its owner can do, never more.
• Keys are shown once, expire after 90 days by default, and can be revoked at once, by their owner or by an administrator.
• A read-only key is enforced by the database: its transactions cannot write.
• A key can be limited to some projects and their sub-projects (since 2026.11.1). It then reaches nothing else, and none of the organization's settings, people or shared configuration.
• A service account holds its own keys and roles, from templates per job with the least privilege that job needs. It can be suspended in one step, and the database refuses to make it an organization administrator.
• Each key is rate-limited, so a runaway script slows down instead of degrading the service for others. The limits are kept per application process.