Which THREE of the following are recommended practices for securing cloud API access? (Choose three.)