We burned hours installing production API keys through a browser agent. Three keys went in and none of them ever authenticated — copying a one-time-displayed secret through a screen distorts characters, and the install reports success anyway. The provider's own "last used" stamp told the truth: blank. The fix was boring and final: the account owner pastes keys with a real clipboard, or the value moves through an API. And you diagnose a key install by the provider's usage record, never by the installer's report.
The point about diagnosing by the provider's own usage record rather than the installer's report is a good one. Did you find any way to catch the distorted characters earlier, for example a checksum or a test call straight after pasting? Or is the usage stamp the only dependable signal for one-time secrets?
commentslikes
