cyber-implementing-api-key-security-controls

name	cyber-implementing-api-key-security-controls
description	Implements secure API key generation, storage, rotation, and revocation controls to protect API authentication credentials from leakage, brute force, and abuse. The engineer designs API key formats with sufficient entropy, implements secure hashing for storage, enforces per-key scoping and rate limiting, monitors for leaked keys in public repositories, and builds key rotation workflows. Activates
source	mukul975/Anthropic-Cybersecurity-Skills
license	Apache-2.0
authorized_lab	false
origin_frontmatter	name: implementing-api-key-security-controls | description: 'Implements secure API key generation, storage, rotation, and revocation | controls to protect API authentication credentials from leakage, brute force, and | abuse. The engineer designs API key formats with sufficient entropy, implements | secure hashing for storage, enforces per-key scoping and rate limiting, monitors | for leaked keys in public repositories, and builds key rotation workflows. Activates | for requests involv
hide	true

Defensive/analysis cyber skill. Source: mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.

Implementing API Key Security Controls

When to Use

• Designing secure API key generation with sufficient entropy and identifiable prefixes for leak detection
• Implementing server-side API key hashing (never storing keys in plaintext) with SHA-256 or bcrypt
• Building key rotation workflows that allow zero-downtime key replacement for API consumers
• Configuring per-key scoping to limit each API key to specific endpoints, IP ranges, and rate limits
• Setting up automated monitoring for API key leakage in GitHub repos, logs, and client-side code

Do not use API keys as the sole authentication mechanism for user-facing applications. API keys are best suited for server-to-server communication and developer access.

Prerequisites

• Secure random number generator (os.urandom, secrets module) for key generation
• Database with proper encryption at rest for storing hashed API keys
• Redis or similar store for key-to-metadata caching and rate limiting
• Secret scanning tools (GitHub secret scanning, truffleHog, gitleaks)
• Monitoring and alerting infrastructure for key usage anomalies

Workflow

Step 1: Secure API Key Generation

import secrets
import hashlib
import hmac
import time
import json
from datetime import datetime, timedelta

class APIKeyManager:
    """Manages secure API key lifecycle: generation, storage, validation, rotation."""

    # Key format: prefix_base64random (e.g., sk_live_a1b2c3d4e5f6...)
    # Prefix identifies the key type and environment for leak detection
    KEY_PREFIXES = {
        "live_secret": "sk_live_",
        "test_secret": "sk_test_",
        "live_public": "pk_live_",
        "test_public": ,
    }

     ():
        .db = db_connection
        .redis = redis_connection

     ():
        
        prefix = .KEY_PREFIXES.get(key_type, )

        
        random_bytes = secrets.token_bytes()
        key_body = secrets.token_urlsafe()  

        
        full_key = 

        
        key_hash = hashlib.sha256(full_key.encode()).hexdigest()

        
        key_id = 

        
        key_metadata = {
            : key_hash,
            : key_id,
            : key_type,
            : owner_id,
            : scopes  [],
            : rate_limit  {: , : },
            : ip_allowlist  [],
            : datetime.utcnow().isoformat(),
            : (datetime.utcnow() + timedelta(days=expires_days)).isoformat(),
            : ,
            : ,
            : ,
        }

        
        .db.execute(
            ,
            (key_hash, key_id, json.dumps(key_metadata))
        )

        
        .redis.setex(
            ,
            ,  
            json.dumps(key_metadata)
        )

         {
            : full_key,       
            : key_id,          
            : key_metadata[],
            : key_metadata[],
        }

     ():
        
        key_hash = hashlib.sha256(api_key.encode()).hexdigest()

        
        cached = .redis.get()
         cached:
            metadata = json.loads(cached)
        :
            
            row = .db.execute(
                ,
                (key_hash,)
            ).fetchone()
              row:
                 , 
            metadata = json.loads(row[])
            
            .redis.setex(, , row[])

        
          metadata.get():
             , 

         metadata.get():
             datetime.fromisoformat(metadata[]) < datetime.utcnow():
                 , 

        
        metadata[] = datetime.utcnow().isoformat()
        metadata[] = metadata.get(, ) + 
        .redis.setex(, , json.dumps(metadata))

         metadata, 

     ():
        
        row = .db.execute(
            ,
            (key_id,)
        ).fetchone()
         row:
            key_hash = row[]
            metadata = json.loads(row[])
            metadata[] = 
            metadata[] = datetime.utcnow().isoformat()

            .db.execute(
                ,
                (json.dumps(metadata), key_id)
            )
            
            .redis.delete()
             
         

     ():
        
        old_row = .db.execute(
            ,
            (old_key_id,)
        ).fetchone()
          old_row:
             , 

        old_metadata = json.loads(old_row[])

        
        new_key_data = .generate_key(
            key_type=old_metadata[],
            owner_id=old_metadata[],
            scopes=old_metadata[],
            rate_limit=old_metadata[],
            ip_allowlist=old_metadata[],
        )

        
        revoke_at = datetime.utcnow() + timedelta(hours=grace_period_hours)
        old_metadata[] = revoke_at.isoformat()
        .db.execute(
            ,
            (json.dumps(old_metadata), old_key_id)
        )

         {
            : new_key_data,
            : old_key_id,
            : revoke_at.isoformat(),
            : 
        },