We're having some spirited debate on best way to manage API keys for our vendors. Some promote a per-vendor key, others per-developer key. Additionally, some want a key-per-environment, so we can authorize a key against our API product per environment (you can hit production once you've seen you can properly hit test). For this, we're thinking of creating different API products for each environment, which seems like a hacky workaround.
Finally, it appears that the same API key is generated for each developer app- not each product that developer. I can see both sides of that argument.
What (best) practices are recommended by Apigee and/or the community for these areas?
Thanks...
LinkedIn
Twitter
