Blast radius
Last verified
Blast radius is the extent of damage a single compromise causes.
A shared key used everywhere has a large one: compromise means revoking it takes down everything at once, and you cannot tell which service leaked it. One key per service shrinks it — you see which key is anomalous, revoke that one, and the rest keeps running.
Admin keys have the largest radius of all, which is the argument for storing them separately from everything else. OpenAI key types.