One key per job, not one key for everything.

Issue as many keys as you have workloads, each with its own scope, its own ceiling, and its own off switch.

Scope a key to specific models, a spend ceiling, a rate limit and an expiry date when you create it.
Every request in the logs carries the key that made it, so attribution and revocation are the same lookup.
Revoke one key without touching the others; re-revealing a key is a role-gated action and is written to the audit log.

One key per job.

The staging job, the nightly batch, the intern’s prototype — each gets its own key with its own model scope, its own ceiling and its own expiry. A key is cheap. A shared key that nobody dares rotate is not.

Revocation without collateral.

Every request carries the key that made it, so finding the source of a spike and switching it off are the same action. Nothing else on the account notices. The secret itself is shown at creation; revealing it again is possible, but role-gated and written to the audit log.