API Key Without Rotation or Expiration

Detects API key implementations without expiration dates or rotation mechanisms, creating long-lived credentials.

zakirkun Updated

File contents

API Key Without Rotation

Overview

Static API keys without expiration or rotation remain valid indefinitely after compromise. Best practices require:

  • Short-lived keys with automatic expiration
  • Easy rotation mechanism
  • Key usage monitoring and anomaly detection
  • Immediate revocation capability

Remediation

  • Add expiration dates to all API keys
  • Implement key rotation workflows
  • Notify users before expiration
  • Monitor for unusual usage patterns

zakirkun/ice-tea/tree/main/skills/api/api-key-rotation-missing commit 84d3ba2ea7

Frequently asked questions

npx skillmds@latest add zakirkun/api-key-without-rotation-or-expiration