Your Agent Should Not Borrow Your API Key

Give the agent its own key, make that key smaller than yours, and let it expire. A borrowed key turns every prompt injection into a call made with your authority.