Give each integration its own named key. Names such as Website translations or Internal tool make it easier to identify the right credential later. Your account shows each key’s status and useful timestamps, without revealing its secret again.
Keep the secret on your application server. Store it in an environment variable or secret manager, and keep it out of source control, browser JavaScript, URLs and logs. A key embedded in a public webpage can be copied by anyone visiting it.
When you need a replacement, use rotation. Choose an overlap period, save the new secret, and update your application. Verify the replacement works before the old key expires. Rotation does not reset your allowance: the account limit still applies across all keys.
If a key is exposed, revoke it from your account and replace it in the affected application. Revocation prevents new requests from being dispatched with that key; it does not cancel a translation already running.
Pace your requests and handle structured error codes. When the API returns Retry-After, wait before making another attempt. A request counts when it is dispatched to the model, including attempts that later fail, so repeated retries can consume your allowance.
Your account page shows recent usage. If your project needs a larger daily allowance, submit a free request there for the daily total you need. More keys do not multiply the free account allowance.