Implements secure API key generation, storage, rotation, and revocation controls to protect API authentication credentials from leakage, brute force, and abuse. The engineer designs API key formats with sufficient entropy, implements secure hashing for storage, enforces per-key scoping and rate limiting, monitors for leaked keys in public repositories, and builds key rotation workflows. Activates for requests involving API key management, API key security, key rotation policy, or API credential protection.
Implements secure API key generation, storage, rotation, and revocation controls to protect API authentication credentials from leakage, brute force, and abuse. The engineer designs API key formats with sufficient entropy, implements secure hashing for storage, enforces per-key scoping and rate limiting, monitors for leaked keys in public repositories, and builds key rotation workflows. Activates for requests involving API key management, API key security, key rotation policy, or API credential protection.
Designing secure API key generation with sufficient entropy and identifiable prefixes for leak detection
Implementing server-side API key hashing (never storing keys in plaintext) with SHA-256 or bcrypt
Building key rotation workflows that allow zero-downtime key replacement for API consumers
Configuring per-key scoping to limit each API key to specific endpoints, IP ranges, and rate limits
Setting up automated monitoring for API key leakage in GitHub repos, logs, and client-side code
Do not use API keys as the sole authentication mechanism for user-facing applications. API keys are best suited for server-to-server communication and developer access.
Prerequisites
Secure random number generator (os.urandom, secrets module) for key generation
Database with proper encryption at rest for storing hashed API keys
Redis or similar store for key-to-metadata caching and rate limiting
# Full API key that the client receives (shown only once)
f"{prefix}{key_body}"
# Hash the key for storage (never store the raw key)
# Create a short key ID for reference (first 8 chars)
f"{prefix}{key_body[:8]}..."
# Store the hashed key with metadata
"key_hash"
"key_id"
"key_type"
"owner_id"
"scopes"
or
"read"
"rate_limit"
or
"requests"
1000
"window"
3600
"ip_allowlist"
or
"created_at"
"expires_at"
"last_used"
None
"is_active"
True
"usage_count"
0
# Store in database
self
"INSERT INTO api_keys (key_hash, key_id, metadata) VALUES (?, ?, ?)"
# Cache in Redis for fast validation
self
f"apikey:{key_hash}"
86400
# 24-hour cache TTL
return
"api_key"
# Show to user ONCE
"key_id"
# For reference/management
"scopes"
"scopes"
"expires_at"
"expires_at"
def
validate_key
self, api_key
"""Validate an API key and return its metadata."""
# Check Redis cache first
self
f"apikey:{key_hash}"
if
else
# Fall back to database
self
"SELECT metadata FROM api_keys WHERE key_hash = ?"
if
not
return
None
"invalid_key"
0
# Refresh cache
self
f"apikey:{key_hash}"
86400
0
# Validation checks
if
not
"is_active"
return
None
"key_revoked"
if
"expires_at"
if
"expires_at"
return
None
"key_expired"
# Update last used
"last_used"
"usage_count"
"usage_count"
0
1
self
f"apikey:{key_hash}"
86400
return
"valid"
def
revoke_key
self, key_id
"""Immediately revoke an API key."""
self
"SELECT key_hash, metadata FROM api_keys WHERE key_id = ?"
if
0
1
"is_active"
False
"revoked_at"
self
"UPDATE api_keys SET metadata = ? WHERE key_id = ?"
# Invalidate cache immediately
self
f"apikey:{key_hash}"
return
True
return
False
def
rotate_key
self, old_key_id, grace_period_hours=24
"""Rotate an API key with a grace period where both old and new keys work."""
self
"SELECT key_hash, metadata FROM api_keys WHERE key_id = ?"
if
not
return
None
"key_not_found"
1
# Generate new key with same settings
self
"key_type"
"owner_id"
"scopes"
"rate_limit"
"ip_allowlist"
# Schedule old key revocation after grace period
"scheduled_revocation"
self
"UPDATE api_keys SET metadata = ? WHERE key_id = ?"
return
"new_key"
"old_key_id"
"old_key_revokes_at"
"message"
f"Old key will be revoked in {grace_period_hours} hours"
"success"
Step 2: API Key Validation Middleware
from flask import Flask, request, jsonify, g
from functools import wraps
app = Flask(__name__)
defrequire_api_key(required_scopes=None):
"""Middleware to validate API key and check scopes."""defdecorator(f):
@wraps(f)defwrapped(*args, **kwargs):
# Extract API key from header
api_key = request.headers.get("X-API-Key")
ifnot api_key:
# Also check Authorization: Bearer <key>
auth_header = request.headers.get("Authorization", "")
if auth_header.startswith("Bearer "):
api_key = auth_header[7:]
ifnot api_key:
return jsonify({"error": "missing_api_key"}), 401# Validate the key
metadata, status = key_manager.validate_key(api_key)
if status != "valid":
return jsonify({"error": status}), 401# Check IP allowlistif metadata.get("ip_allowlist"):
client_ip = request.remote_addr
if client_ip notin metadata["ip_allowlist"]:
return jsonify({"error": "ip_not_allowed"}), 403# Check scopesif required_scopes:
key_scopes = set(metadata.get("scopes", []))
ifnot key_scopes.intersection(required_scopes):
return jsonify({"error": "insufficient_scope"}), 403# Attach metadata to request context
g.api_key_metadata = metadata
return f(*args, **kwargs)
return wrapped
return decorator
@app.route('/api/v1/data', methods=['GET'])@require_api_key(required_scopes=["read", "admin"])defget_data():
return jsonify({"data": "sensitive information"})
@app.route('/api/v1/data', methods=['POST'])@require_api_key(required_scopes=["write", "admin"])defcreate_data():
return jsonify({"created": True})
Step 3: Automated Key Leakage Detection
# Scan GitHub repositories for leaked API keys using gitleaks
gitleaks detect --source=/path/to/repo --config=gitleaks.toml --report-path=leaks.json
# Custom gitleaks configuration for API key prefix detection# gitleaks.tomlcat <<'EOF'
[[rules]]
id = "company-api-key-live"
description = "Company Live API Key"
regex = '''sk_live_[A-Za-z0-9_-]{32,}'''
tags = ["api-key", "live", "critical"]
[[rules]]
id = "company-api-key-test"
description = "Company Test API Key"
regex = '''sk_test_[A-Za-z0-9_-]{32,}'''
tags = ["api-key", "test"]
[[rules]]
id = "company-public-key"
description = "Company Public API Key"
regex = '''pk_live_[A-Za-z0-9_-]{32,}'''
tags = ["api-key", "public"]
EOF
# Automated leaked key revocationimport json
defprocess_leaked_keys(leaks_file):
"""Automatically revoke API keys detected in public repositories."""withopen(leaks_file) as f:
leaks = json.load(f)
for leak in leaks:
key_match = leak.get("match", "")
# Extract the key from the matchfor prefix in ["sk_live_", "sk_test_", "pk_live_"]:
if prefix in key_match:
start = key_match.index(prefix)
potential_key = key_match[start:start+50] # Max key length# Validate and revoke
metadata, status = key_manager.validate_key(potential_key)
if status == "valid":
key_manager.revoke_key(metadata["key_id"])
print(f"[REVOKED] Key {metadata['key_id']} leaked in {leak.get('file')}")
# Notify the key owner
notify_owner(metadata["owner_id"], metadata["key_id"], leak)
Key Concepts
Term
Definition
API Key
A secret string used to authenticate API requests, typically passed in headers or query parameters
Key Hashing
Storing only the hash (SHA-256) of the API key in the database, never the plaintext key, similar to password hashing
Key Rotation
Replacing an API key with a new one while maintaining a grace period where both keys work, ensuring zero-downtime transition
Key Scoping
Limiting each API key to specific endpoints, HTTP methods, IP ranges, and rate limits to minimize blast radius
Key Prefix
An identifiable prefix (e.g., sk_live_) that enables automated detection of leaked keys in logs, code, and public repositories
Secret Scanning
Automated monitoring of repositories, logs, and public sources for exposed API keys and credentials
Tools & Systems
GitHub Secret Scanning: Built-in GitHub feature that detects exposed secrets in repositories and alerts key providers
gitleaks: Open-source tool for detecting secrets in git repositories using customizable regex patterns
truffleHog: Secret scanning tool that searches entire git history for high-entropy strings and known secret patterns
HashiCorp Vault: Enterprise secret management system for API key storage, rotation, and dynamic credential generation
AWS Secrets Manager: Managed secret storage with automatic rotation support for API keys and credentials
Common Scenarios
Scenario: API Key Security Program for Developer Platform
Context: A developer platform provides public APIs authenticated with API keys. The platform has 10,000+ API consumers generating 50M+ requests per day. Keys are frequently leaked in public GitHub repositories.
Approach:
Implement prefixed API keys (sk_live_, sk_test_) with 256-bit entropy for leak detection
Store only SHA-256 hashes of keys in the database, cache validated keys in Redis
Implement per-key scoping: each key restricted to specific endpoints, rate limits, and optional IP allowlists
Build key rotation API with 24-hour grace period for seamless transitions
Integrate with GitHub Secret Scanning to automatically detect and revoke leaked keys within minutes
Run gitleaks in CI/CD pipelines to prevent key commits in first place
Implement anomaly detection: alert on keys used from unusual IPs or with abnormal traffic patterns
Add key expiration policy: all keys expire after 365 days with 30-day advance notification
Pitfalls:
Storing API keys in plaintext in the database (use SHA-256 hashing)
Using predictable or low-entropy key generation (use cryptographically secure random generators)
Not implementing key prefixes, making it impossible to identify leaked keys in automated scans
Allowing API keys in URL query parameters where they leak in logs, browser history, and Referer headers
Not implementing rate limiting per key, allowing a single compromised key to abuse the entire API
Output Format
## API Key Security Implementation Report
**Platform**: Developer API v3
**Total Active Keys**: 12,450
**Daily Key Validations**: 52M
### Security Controls
| Control | Implementation | Status |
|---------|---------------|--------|
| Key Entropy | 256-bit (secrets.token_urlsafe(32)) | Implemented |
| Key Format | sk_live_/sk_test_ prefixed | Implemented |
| Storage | SHA-256 hashed, Redis cached | Implemented |
| Scoping | Per-key endpoint/IP/rate limits | Implemented |
| Rotation | 24-hour grace period API | Implemented |
| Expiration | 365-day max TTL | Implemented |
| Leak Detection | GitHub Secret Scanning + gitleaks | Active |
| Auto-Revocation | Leaked keys revoked within 5 min | Active |
### Key Leakage Stats (Last 30 Days)
- Keys detected in public repos: 23
- Average time to revocation: 3.2 minutes
- Keys detected in CI/CD pre-commit: 7 (prevented)
