Reject Raw API Keys in Inference Engines

Security Requirement

Inference engines MUST reject raw API keys as an authentication mechanism. If legacy interoperability requires API key support, the inference engine (or an API gateway in front of it) MUST proxy and convert API keys into short-lived IdP-issued tokens before processing the request.

Rationale

API keys present significant security risks in production:

• Typically long-lived, increasing exposure window if compromised
• Difficult to rotate across distributed systems
• Lack fine-grained scoping and sender binding
• Cannot be revoked instantly without infrastructure support
• Do not carry identity claims needed for audit trails

Acceptable Approach for Legacy Interop

When legacy systems require API key authentication: