API Key Security
Keep project credentials isolated and revocable.
Use one project key per store or environment. Store secrets in a server-side secret manager, never a browser bundle. Rotate by creating and deploying a replacement before revoking the old key. A key is project-bound and cannot override its project with X-Project-Id.