3 ms·
Aren't we supposed to be rotating our keys when someone leaves no matter what technical solution to this problem we're using?
by noSyncCloud 4y ago
Aren't we supposed to be rotating our keys when someone leaves no matter what technical solution to this problem we're using?
- scarface74 4y agoWell, I was trying to avoid the entire rant about using API Keys for security in the first place. https://zapier.com/engineering/apikey-oauth-jwt/ https://zapier.com/engineering/apikey-oauth-jwt/ https://cloud.google.com/endpoints/docs/openapi/when-why-api-key https://cloud.google.com/endpoints/docs/openapi/when-why-api... We all have done it at one point or another. But if I am ever in the middle of a technical presentation and mention “API Keys”, I get all types of dirty looks from security. Notice that Square for instance strongly discourages API Keys for production. https://developer.squareup.com/docs/build-basics/access-tokens https://developer.squareup.com/docs/build-basics/access-toke... On the AWS side (where I work) we always discourage long term use of access key/secret keys for accessing resources even though I realize it’s necessary for some integrations. Even then, most organizations also put a condition that you can only use it from known IP addresses.