[noirbot]

It's also useful for things like secure temporary password delivery. I set up your account for the first time with a new service, generate a temp password you have to reset on first login, and then share it to your Password Manager space.

Also just useful for things like API keys - my team just has all of our team's allocated API keys for various services in our password manager so we don't have to go look them up in all of the various service's sites if we need them.

[scarface74]

I understand the temporary password use case. But what do you do when an employee leaves? Do you change all of the API keys?

[noSyncCloud]

Aren't we supposed to be rotating our keys when someone leaves no matter what technical solution to this problem we're using?

[scarface74]

Well, I was trying to avoid the entire rant about using API Keys for security in the first place.

https://zapier.com/engineering/apikey-oauth-jwt/

https://cloud.google.com/endpoints/docs/openapi/when-why-api...

We all have done it at one point or another. But if I am ever in the middle of a technical presentation and mention “API Keys”, I get all types of dirty looks from security.

Notice that Square for instance strongly discourages API Keys for production.

https://developer.squareup.com/docs/build-basics/access-toke...

On the AWS side (where I work) we always discourage long term use of access key/secret keys for accessing resources even though I realize it’s necessary for some integrations. Even then, most organizations also put a condition that you can only use it from known IP addresses.