This Key Will Self-Destruct: An Open Standard for Revocable API Keys
SecurityWeek opinion piece proposes ORKS, an open standard adding issuer prefixes, discovery files, and unauthenticated revocation endpoints to make leaked API keys quickly revocable.
The article argues that plain API keys leak frequently yet lack any standardized revocation mechanism, unlike OAuth tokens which gained RFC 7009 revocation in 2013, and that GitHub's Secret Scanning Partner Program solves this only in a proprietary, invite-only way. The author proposes ORKS (Open Revocable Key Standard), with a draft spec on GitHub, built on four parts: keys embedding their issuer domain in a fixed prefix format, a discoverable /.well-known/api-key-config JSON file, unauthenticated revocation by possession of the full key, and declared constraints such as IP allowlists, expiry, scopes, and mTLS. An optional quarantine mode inspired by Toyota's andon cord restricts a reported key to read-only and throttled operation for a default 24-hour window before automatic revocation. The piece frames AI agents as making this urgent, since agents hold many credentials, can exfiltrate them via prompt injection, and can leak secrets into logs at machine speed.
- ORKS keys embed the issuer domain: orks_{issuer}_{secret}_{check} format with checksum to cut false positives.
- Issuers publish /.well-known/api-key-config listing revocation endpoint, security contact, and supported constraints.
- Revocation by possession lets anyone holding a key POST it to kill it, with optional quarantine mode limiting blast radius.
- AI agents amplify credential risk: prompt injection can exfiltrate keys, which then leak into logs at machine speed.
- Cites RFC 7009 OAuth token revocation and GitHub's Secret Scanning Partner Program as partial precedents.
From the original article
5 min read at securityweek.com
Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. The post This Key Will Self-Destruct: An Open Standard for Revocable API Keys appeared first on SecurityWeek.
By Matt Honea · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.