# Authentication
Source: https://nordvec.com/docs/guides/authentication#good-practice

## Good practice [#good-practice]

- Store keys in a secret manager or environment variable, never in source code.
- Use a separate key per service or environment so you can revoke narrowly.
- Set an expiry on keys for CI and scripts.