Here is a question worth being uncomfortable about: if one of your API keys leaked right now, how would you find out?
Not "how would you rotate it" — that part is easy. How would you notice?
A stolen key does not look stolen. It authenticates correctly, because it is a valid key. It hits the same endpoints, because whoever took it wants the same functionality you built. It bills to the same account. Every row it writes to your usage log looks exactly like a row you wrote.
The only thing that differs is where it comes from. Someone else's server is not the one you deploy from.
Which means if you are not recording the caller's address alongside the usage, there is no evidence a theft ever happened. You find out from the bill, weeks later, and even then you cannot tell which calls were yours.
