A city must manage Claude API keys for production apps. Which secrets practice fits?
Select an answer to reveal the explanation.
Short Explanation
Think of API keys like building master keys—rotate them on a schedule and keep them in the vault, not the hallway.
Full Explanation
Production Claude API keys are privileged credentials for municipal apps that can incur cost, exfiltrate prompts, or act through connected tools. Sound secrets hygiene stores keys only in the enterprise vault and rotates them on a fixed cadence such as quarterly so compromised material expires and access is revalidated. Storing encrypted Claude API keys in app config files versioned with service code still leaves secrets in repo history, diffs, and CI logs, where encryption does not prevent accidental exposure or unauthorized decryption. Reusing staging Claude API keys in production to consolidate usage metering blurs environment boundaries, carries over less-controlled credentials, and complicates production audit and rotation. Embedding Claude API keys in frontend portal builds to reduce backend proxy latency ships secrets to the client, where they are recoverable from browser bundles and network traces regardless of performance goals. Exam caveat: rotation without vault storage still leaves keys in tickets and repos; vault storage without rotation leaves stolen keys usable indefinitely—both practices are required together. Operational check: verify production apps resolve keys from the vault at runtime, that repo scanners find no Anthropic key material, and that a rotation drill updates vault secrets and restarts callers without downtime or leaked intermediate copies.