Create for one purpose
Give each integration its own descriptive key so it can be identified and revoked independently. Use only an account authorised to manage developer settings.
Treat the secret like a password
Copy the value when it is shown and store it in a server-side secret manager or environment setting. Send it as the x-api-key request header. Never put it in browser code, screenshots, tickets, URLs, or source control; QuickDesk stores only its hash and cannot show the value again.
Rotate safely
Create and deploy the replacement before revoking an active key. Keys use the selected role and optional site scope, do not inherit their creator's permissions, do not consume a seat, and are limited to 120 requests a minute. If exposure is suspected, revoke first, then investigate failed requests and issue a new limited key.