API Key Without Rotation
Overview
Static API keys without expiration or rotation remain valid indefinitely after compromise. Best practices require:
- Short-lived keys with automatic expiration
- Easy rotation mechanism
- Key usage monitoring and anomaly detection
- Immediate revocation capability
Remediation
- Add expiration dates to all API keys
- Implement key rotation workflows
- Notify users before expiration
- Monitor for unusual usage patterns