Review the API keys in your account

Build a useful key inventory, identify unused connections and reduce the impact of a lost or exposed key.

Prepare an API-key review checklist for the MandAPI keys used by this application. Inspect configuration names and deployment documentation without reading or displaying real secret values. Produce an inventory of application, environment, owner, secret reference and known restrictions. Mark unknown fields explicitly. Recommend stale keys for owner review, but do not revoke keys or change production settings automatically. Use only MandAPI account capabilities that the owner can actually see.

Start with your own account

Open the API-key section of your MandAPI dashboard. This recipe reviews keys you control. It does not assume that user groups provide an organization, shared wallet or team permission system.

Use one key per application or environment where practical. A recognizable label makes an incident easier to investigate than a list of unnamed keys.

Build a small inventory

Record the information available in the dashboard and your deployment inventory:

Field	What to record
Label	Application and environment
Owner	Person responsible for replacing it
Location	Secret-store entry or deployment name
Purpose	Chat, testing or another verified use
Restrictions	Actual limits and expiry you configured
Last confirmed use	Your own deployment or request evidence
Action	Keep, investigate or revoke

Never put the complete key in this inventory. You usually need its label and the secret-store reference, not the credential value. If the dashboard does not show a field, mark it unknown rather than guessing.

Review access and limits

Compare the inventory with running applications. A stopped demo, deleted deployment or former integration may no longer need its key. Investigate first so you do not interrupt an application that still uses it.

Where your key settings provide model restrictions, credit limits or expiry, configure the settings appropriate to that application's purpose. Confirm what is actually saved. Do not assume that a label or a limited application UI enforces a backend restriction.

A suspected exposure needs rotation, not merely a nicer label. Create a replacement key, update the application, verify its connection and revoke the old key.

Check the result

Every retained key should have a known purpose and replacement owner. Each unused key should have an explicit decision. Check the account after a change to confirm that the intended key was revoked or restricted.

Repeat the review after changing deployments, adding a new application or discovering a leak. This is an account-maintenance checklist, not a claim that MandAPI automatically audits keys or supplies an organization-wide audit API.