How you authenticate ingestion shapes how easily you can rotate, scope, and secure it. API keys scoped per environment are simpler to operate than embedded connection strings.
One Key Per Environment
Production, staging, and development each get their own API key. Telemetry is attributed correctly and a leaked staging key never exposes production.
instrument.ts
AllStak.init({
apiKey: process.env.ALLSTAK_API_KEY,
environment: "production",
release: "v2.4.1",
})Rotate Without Redeploying
Because the key lives in an environment variable, rotating it is a config change — not a code change and redeploy. Revoke a compromised key instantly.
Scoped Access
Keys are scoped to a project and environment, so access is least-privilege by default. No single string grants access to everything.