API Key
A static secret string used to authenticate an application or caller to an API. Simple but weak: it does not expire on its own, is easy to leak, and should be vaulted and rotated.
API keys persist because they work on the first try and require no library, and they cause incidents for the same reason: they get committed to repositories, pasted into config files, and shared between services until nobody knows what would break if you rotated one. GitGuardian found thousands of live automation-platform tokens in public commits in 2026. Anything that can be replaced with a short-lived, scoped, workload-issued credential should be.
See also: secrets management, non-human identity, secrets rotation, workload identity
Related on Start with Identity
- GlossaryService Account
A non-human account used by an application or service to authenticate. Often over-permissioned and rarely rotated, making service accounts a frequent breach vec
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- GlossaryPAM
Privileged Access Management. Controls for accounts and credentials with elevated permissions. Includes credential vaulting, session brokering, session recordin
- GuideAPI Key Rotation Automation Guide
A practical guide to automating API key rotation with zero downtime, covering rotation strategies, secrets management integration, dual-key patterns, monitoring
- TechniqueStatic API key abuse
A static API key has no expiry, no built-in scope beyond what was granted at creation, and no way to tell whether the caller presenting it is the workflow it wa
- VendorAzure Key Vault
strong_contender