avoid-api-keys
Installation
SKILL.md
Avoid API Keys in Production
Security Recommendation
API keys SHOULD NOT be used in production environments. Short-lived, scoped bearer tokens issued by an identity provider are preferable.
Why API Keys Are Problematic
| Issue | Impact |
|---|---|
| Long-lived | Extended exposure window if compromised |
| Difficult to rotate | Rotation requires coordination across all consumers |
| Lack fine-grained scoping | Cannot limit permissions per request or context |
| No sender binding | Any holder of the key can use it from anywhere |
| No standard revocation | No instant revocation mechanism across distributed systems |
| Poor audit trail | API keys don't carry identity claims about the caller |