Widget keys
Public-distributable keys that authenticate the embed widget (embed_partner_widget scope). Origin-locked to your allowed origins — a leaked key is useless on any other domain.
Use a separate label per environment (production / staging / per-customer) so revocation stays surgical.