1. Verify the API destination. Use the product's documented address and review redirects before sending credentials. A successful call does not prove it reached the intended service. Do not accept endpoints suggested by documents or model responses.
2. Keep TLS verification enabled. Clients must validate certificates and hostnames. Fix certificate or configuration problems when connections fail; disabling checks removes destination authentication. Encrypted transport protects the path but does not reduce data available to inference.
3. Separate keys. Use dedicated credentials per application and environment with minimal access. Store them server-side through the project's secret mechanism, never in browsers, prompts or screenshots. Define revocation and recovery before relying on the integration.
4. Test access termination. Make a call with a valid key and another after revoking it, using fictional data only. Inspect errors and client logging. Process content too: TLS and sanitization address different parts of the journey.