Least‑privilege API key vs never‑expiring key in Plotly authentication
The goal is to authenticate Plotly API clients while applying least‑privilege principles and avoiding credentials that remain valid indefinitely. Plotly.js has no built‑in token expiration, so API keys are long‑lived, inherit the owner’s full permissions, and workspace roles cannot restrict key scope for client‑side requests. A personal API key offers simpli