API Key
A static secret string used to authenticate an application or caller to an API. Simple but weak: it does not expire on its own, is easy to leak, and should be vaulted and rotated.
API keys persist because they work on the first try and require no library, and they cause incidents for the same reason: they get committed to repositories, pasted into config files, and shared between services until nobody knows what would break if you rotated one. GitGuardian found thousands of live automation-platform tokens in public commits in 2026. Anything that can be replaced with a short-lived, scoped, workload-issued credential should be.
See also: secrets management, non-human identity, secrets rotation, workload identity
Related on Start with Identity
- GlossaryCredential Brokering
Credential brokering is the pattern in which an intermediary fetches a credential from a vault or credential store at the moment of access and hands it to an al
- GlossaryMachine Identity
A machine identity is the credential that lets a device, server, application or workload prove who it is to another system without a person signing in: most oft
- GlossaryService Account
A non-human account used by an application or service to authenticate. Often over-permissioned and rarely rotated, making service accounts a frequent breach vec
- GuideAPI Key Rotation Automation Guide
A practical guide to automating API key rotation with zero downtime, covering rotation strategies, secrets management integration, dual-key patterns, monitoring
- TechniqueStatic API key abuse
A static API key has no expiry, no built-in scope beyond what was granted at creation, and no way to tell whether the caller presenting it is the workflow it wa
- BlogA phantom join key let anyone mint JFrog Artifactory admin tokens, and exploitation started in days
CVE-2026-82329 (CVSS 9.8) is an authentication bypass in JFrog Access. Instances without an explicit join key got a predictable one, letting an unauthenticated