Generating, Managing, and Rotating API Keys

Step-by-Step API Key Generation Across Platforms

AWS API Key Generation (AWS Access Keys)
AWS IAM (Identity and Access Management) provides access keys for programmatic access to services like S3, Lambda, or EC2. Keys are generated via the AWS Console or CLI with explicit permission scopes.

Prerequisites:

AWS account with IAM permissions to create access keys.

Admin or user with `iam:CreateAccessKey` policy attached.

1. Via AWS Console:
   Navigate to the IAM dashboard, select "Users," and choose the target user. Under the "Security credentials" tab, click "Create access key." AWS generates a Access Key ID and Secret Access Key (displayed once). Store the secret key securely—it cannot be retrieved later.
2. Via AWS CLI:
   Use the following command to generate a key programmatically:

   aws iam create-access-key --user-name

   The output includes:

   {
   "AccessKey": {
   "UserName": "example-user",
   "AccessKeyId": "AKIAEXAMPLE123",
   "Status": "Active",
   "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
   "CreateDate": "2023-10-01T00:00:00Z"
   }
   }
   

3. Assign Permissions:
   Attach an IAM policy to the key (e.g., `AmazonS3FullAccess`) via the IAM console or CLI:

   aws iam attach-user-policy --user-name --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess
   

Prerequisites:

GitHub account with repository access.

Two-factor authentication (2FA) enabled (recommended for security).

1. Navigate to Settings > Developer settings > Personal access tokens > Tokens (classic). Click "Generate new token."
2. Configure token settings:
   
3. Note: Add a descriptive name (e.g., "CI/CD Automation").
4. Expiration: Set a custom date or use "No expiration" (not recommended for production).
5. Scopes: Select required permissions (e.g., `repo`, `workflow`, `admin:public_key`).
6. After generation, the token is displayed once. Copy it immediately and store it in a secure vault (e.g., HashiCorp Vault or AWS Secrets Manager).

Best Practices:

Use cryptographically secure random generators.

Store keys in environment variables or a secrets manager.

Implement key validation on the server side.

import secrets
import uuid

def generate_api_key():

Generate a 32-character alphanumeric key

Alternatively, use UUID for structured keys

key = str(uuid.uuid4())

# Example usage in a Django model
from django.db import models

class APIKey(models.Model):
key = models.CharField(max_length=64, unique=True, default=generate_api_key)
user = models.ForeignKey(User, on_delete=models.CASCADE)
is_active = models.BooleanField(default=True)
created_at = models.DateTimeField(auto_now_add=True)

Node.js Example (Express.js):

const crypto = require('crypto');

function generateAPIKey() {
return crypto.randomBytes(32).toString('hex');
}

// Example usage in Express middleware
const express = require('express');
const app = express();

app.get('/api/key', (req, res) => {
const key = generateAPIKey();
res.json({ apiKey: key });
});

API Key Management Policy Template

Policy Applicability:

Applies to all developers, DevOps teams, and third-party services using API keys.

Aligns with compliance requirements (e.g., GDPR, SOC 2, ISO 27001).

2. Audit Logs and Monitoring
Implement logging for key-related actions and set up alerts for suspicious activity.

3. Incident Response Plan
Outline steps for key compromise or unauthorized access.

4. Key Rotation Schedule
Define rotation intervals based on risk assessment.

5. Compliance and Training

Automating API Key Rotation

Prerequisites for Automation:

Linux/macOS: Cron Job for Key Rotation
Use `cron` to rotate keys at scheduled intervals. Example script for AWS key rotation:

#!/bin/bash

Rotate AWS IAM access keys every 60 days

if [ -n "$OLD_KEY" ]; then

Invalidate old key

# Generate new key
NEW_KEY=$(aws iam create-access-key --user-name $USERNAME --query "AccessKey.AccessKeyId" --output text)
NEW_SECRET=$(aws iam create-access-key --user-name $USERNAME --query "AccessKey.SecretAccessKey" --output text)

# Store new secret securely (e.g., using AWS Secrets Manager)
echo "New key generated: $NEW_KEY"
aws secretsmanager create-secret --name "aws-key-$USER

Troubleshooting Common API Key Issues

Diagnostic Checklist for API Key Errors

Root Cause Analysis Framework:
1. Request-Level Issues – Incorrect headers, malformed payloads, or missing key placement.
2. Key-Level Issues – Expired, revoked, or improperly formatted keys.
3. Permission-Level Issues – Scope restrictions or insufficient privileges.
4. Server-Level Issues – Rate limits, throttling, or backend failures.

Validating API Key Permissions Against Service Documentation

API documentation typically defines scopes using:

Permission Validation Workflow:
1. Extract the required scopes from the API documentation for the target endpoint.
2. Compare against the key’s assigned scopes (often listed in the API provider’s dashboard).
3. Test with minimal privileges to confirm scope enforcement.