Keep your API keys boring
Three habits, none of them clever:
Give a key only the permissions the job needs. If a strategy never withdraws, the key it uses should be unable to withdraw. Most damage stories start with a key that could do more than its job.
Use separate keys for separate purposes, so revoking one doesn't take down everything.
And know how to revoke, before you need to. Find the button now, not while your hands are shaking.
