API Key Management in Practice: Preventing Leakage, Abuse, and Bypass
Last year, a client came to me confused: “Our API keys are stored in a private GitHub repository. Isn't that secure?”
I asked: “Do you believe a private repository can never leak?”
GitHub's secret scanning detects millions of exposed secrets annually — and a significant portion come from private repositories. Employees accidentally make repos public, departing developers clone code, or third-party integrations expose the data. Hardcoding API keys in source code is like taping a key to your front door: the door is locked, but everyone can see the key.
API keys are the “proof of identity” that applications use to access external services. Once leaked, attackers don't need to break anything — they just use valid credentials to log in to your systems.
01 Three Leakage Vectors
Hardcoded in source code
Developers embed API keys or cloud access keys directly into code for convenience. Once committed to version control, the key is permanently in the commit history. GitHub's secret scanning can detect these and notify providers, but before that happens, automated tools may already have discovered the exposed credentials.
Configuration file exposure
Keys placed in .env files or configuration files are committed alongside the code. In Uber's 2016 breach, attackers found an embedded AWS key on GitHub — the same attack pattern led to the exposure of 57 million user records .
Frontend code exposure
Research scanning 10 million web pages detected 1,748 valid credentials exposed across 14 service providers. 84% of verified exposures came from JavaScript resources — 62% from bundled files and 16% from third-party inclusions . Frontend code is plaintext; any key placed there is effectively public.
02 Key Lifecycle Management
Generation: use cryptographically secure randomness
Keys must be generated by a cryptographically secure random number generator. Avoid “simple encryption” or custom algorithms for key generation — that's obfuscation, not security, and can be broken in seconds.
Storage: use dedicated key management services
AWS Secrets Manager, Azure Key Vault, and HashiCorp Vault provide dedicated storage and rotation capabilities. AWS Secrets Manager encrypts secrets at rest using KMS keys (AES-256 envelope encryption), transmits them over TLS, and by default does not write the plaintext secret to persistent storage . Secrets Manager integrates with CloudTrail for audit logging and IAM for fine-grained access control .
Distribution: deliver through secure channels
Alibaba Cloud recommends using temporary STS credentials instead of long-term AccessKeys. Tencent Cloud's API key management hides the SecretKey after creation; you can only view it once — if you lose it, you must regenerate .
03 Least Privilege
API key permissions should follow least privilege. Huawei Cloud's API key management allows restricting access to specific model services, IP whitelists, or custom endpoints . Zendesk's Enterprise plan provides audit logs showing key creation, deactivation, and reactivation events .
Best practices:
By scenario: read-only, read-write, and admin keys
By environment: separate keys for development, staging, and production
IP allow listing: only permit requests from specific IP ranges
By role: different roles require different permission sets
04 Rotation and Auditing
Regular rotation: The US Cybersecurity and Infrastructure Security Agency (CISA) recommends rotating API keys at least every 90 days . AWS Secrets Manager supports scheduled rotation without application impact by using a two-key mechanism: primary and secondary keys can be alternated, so rotation doesn't require application downtime .
Audit tracking: Tencent Cloud API key management provides access logs showing the last used time, which helps identify stale keys . Alibaba Cloud's AK audit feature can detect abnormal usage patterns.
The Bottom Line
API key management is not about “storing them safely.” The root cause of leaks is storing them in the wrong place. The correct approach is:
Never hardcode keys in source code
Use dedicated secret management services for storage and rotation
Enable audit logging and monitoring to detect abnormal usage
Apply least privilege when assigning key permissions
Rotate keys regularly — the two-key model maintains business continuity
That client later removed all hardcoded keys and switched to Secrets Manager. “I used to lose sleep over key leaks,” they said. “Now I don't.”
Are your API keys still in your codebase?
