Let's move away from API keys!

API keys management

35% of all exposed API keys are still active - 35% of exposed API keys still active, posing major security risks - Help Net Security

What's the problem with using API keys?

// Define the API endpoint and the API key
const apiEndpoint = 'https://api.example.com/data';
const apiKey = 'your_api_key_here';

// Function to call the API
async function fetchData() {
    try {
        const response = await fetch(apiEndpoint, {
            method: 'GET',
            headers: {
                'Content-Type': 'application/json',
                'Authorization': `Bearer ${apiKey}`
            }
        });

        if (!response.ok) {
            throw new Error(`HTTP error! status: ${response.status}`);
        }

        const data = await response.json();
        console.log(data);
    } catch (error) {
        console.error('Error fetching data:', error);
    }
}

// Call the function to fetch data
fetchData();

Exposure

But can't I just rotate my API keys often?

Static nature:

I rotated the keys as soon as we learned they were exposed, that's surely enough or?

Lack of Granular Control

I can just create different types of API keys for different parts of the API, no?

Insecure Storage

Secret Sprawl

Which leads to:

• Data Breaches: Unauthorized access to sensitive data if API keys are compromised.
• Privilege Escalation: Attackers can use exposed keys to gain higher levels of access within a system.
• Service Disruption: Malicious use of API keys can lead to denial-of-service attacks or other disruptions.

How to fix it?

• OAuth is an open standard for access delegation. OAuth allows users to authorize third-party applications to access their information on another service without sharing their credentials. Instead of sharing passwords, OAuth uses access tokens. These tokens are issued by an authorization server and contain specific permissions about what data the third-party app can access. OAuth also defines scopes, which specify the level of access granted. In conclusion, by not sharing passwords, OAuth reduces the risk of credential theft. Even if a token is compromised, it has limited scope and can be easily revoked
• Store secrets securely, keys, and secrets in general, don't belong in source code or in files that are checked into version control. If you can, store them in a service like for example Azure Key Vault
• Regularly rotate your keys. Ensure your API keys are replaced regularly with new keys. Make sure you know how long ago you replaced a key, make sure services relying on this API key are managed.
• Apply a cloud vendor's recommendation on best services for protecting your secrets and cloud resources.

References

• 35% of exposed API keys still active, posing major security risks. https://www.helpnetsecurity.com/2024/08/13/api-keys-secrets/.
• Is the API-key enough? API security issues and their fix. https://api-university.com/blog/is-the-api-key-enough-common-api-security-issues-and-how-to-fix-them/.
• Keep API Keys Safe, Because The Repercussions Are Huge. https://nordicapis.com/keep-api-keys-safe-because-the-repercussions-are-huge/.
• API Keys ≠ Security: Why API Keys Are Not Enough - Nordic APIs. https://nordicapis.com/why-api-keys-are-not-enough/.
• Dev center