1. Identify who controls the credential
Ask whether the key is created for you, shared among buyers, or controlled by a seller. Confirm whether you can rotate and revoke it independently. If the answer is unclear, do not use the credential for customer data or production automation.