3 ms·
I understand the temporary password use case. But what do you do when an employee leaves? Do you change all of the API keys?
by scarface74 4y ago
I understand the temporary password use case. But what do you do when an employee leaves? Do you change all of the API keys?
- noSyncCloud 4y agoAren't we supposed to be rotating our keys when someone leaves no matter what technical solution to this problem we're using?
- scarface74 4y agoWell, I was trying to avoid the entire rant about using API Keys for security in the first place. https://zapier.com/engineering/apikey-oauth-jwt/ https://zapier.com/engineering/apikey-oauth-jwt/ https://cloud.google.com/endpoints/docs/openapi/when-why-api-key https://cloud.google.com/endpoints/docs/openapi/when-why-api... We all have done it at one point or another. But if I am ever in the middle of a technical presentation and mention “API Keys”, I get all types of dirty looks from security. Notice that Square for instance strongly discourages API Keys for production. https://developer.squareup.com/docs/build-basics/access-tokens https://developer.squareup.com/docs/build-basics/access-toke... On the AWS side (where I work) we always discourage long term use of access key/secret keys for accessing resources even though I realize it’s necessary for some integrations. Even then, most organizations also put a condition that you can only use it from known IP addresses.