Software Development
API Auth Key Management
Design the API-key authentication surface a platform issues to its own API consumers - key format with prefix+checksum conventions, hashed (irretrievable) vs encrypted (retrievable) storage, zero-downtime rotation with dual-key overlap, least-privilege scoping, individual vs org vs service-account ownership, self-service key dashboard behavior, and SOC 2 / PCI-DSS 4.0 lifecycle governance. Use whenever the user mentions API keys, secret keys, key prefixes, key rotation, key scoping, or revoking keys after an employee departure - even if they never say "API key management". Provider side only, not consuming another vendor's API. Do NOT use for OAuth authorization-server design - use samber/developer-platform-skills@oauth2-provider-design instead.
- Publisher / source
- samber/developer-platform-skills (found on skills.sh)
- Upstream record
- samber/developer-platform-skills
- Version
- Version 3
- Published
- Publication review
- Approved for publication
- Content fingerprint
9c38bc895c97d73189b84fa5206ad6eaa9323a91ab196699ee72dbf9f5cfcd99