Create scoped API keys — live or test — with optional IP and environment restrictions and an expiry. Give automation its own service account with its own keys, so a person leaving never quietly breaks a pipeline.
Keys are scoped to exactly what they should touch, issued as live or test, and can be pinned to an IP range or an environment and given an expiry. Give automation a service account — a non-human identity that owns its own keys — so a pipeline outlives the person who set it up. A key can never carry more access than its owner, so least-privilege is the default rather than something you remember to configure.