Managing API keys

From API management, choose Create API key, name it after what will use it (for example, "CI deploy pipeline"), and select only the scopes that workflow needs. The full key value is shown once at creation — store it in your secret manager or CI provider immediately.

Prefer read-only scopes wherever possible. A key used only to export audit events for a SIEM integration should hold the audit:read scope and nothing else.

Review API management periodically for keys that haven't been used recently, and revoke any key as soon as the workflow using it is retired. Revocation takes effect immediately for all future requests.