skills.rest
marquesfelip
marquesfelipCOMMUNITY
Explore all skills by this author →
GitHub

api-key-management

Design, rotate, and audit API keys for SaaS applications.

Updated Mar 29, 2026
Search Tags:#security#authentication#auditing#api-keys#rotation#scopes
One-click install
npx skills add https://github.com/marquesfelip/agents-and-skills --skill api-key-management
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-key-management
Source: https://github.com/marquesfelip/agents-and-skills/tree/main/skills/api-key-management
Command: npx skills add https://github.com/marquesfelip/agents-and-skills --skill api-key-management

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

API key management is critical for SaaS security. Without a robust workflow, keys can be leaked, misused, or lack auditable visibility across tenants and users.

Core Features & Use Cases

  • Secure key generation with high-entropy prefixes and salted SHA-256 hashing for safe storage and fast lookup.
  • Per-tenant and per-user scopes with expiry, revocation, and rotation support to minimize blast radius.
  • Auditable event logs capturing creation, rotation, revocation, and last-used metrics to support compliance and incident response.
  • Data model and operational guidance for embedding API key management into services, RBAC, and CI/CD workflows.

Quick Start

Create a new API key for a user in your tenant and securely store the full key shown at creation.

Frequently Asked Questions about api-key-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I securely store API keys for a multi-tenant SaaS application?▼

Securely store API keys by generating high-entropy values with prefixes and applying salted SHA-256 hashing. This approach enables safe storage and fast lookup while supporting per-tenant and per-user key ownership across multi-tenant environments.

What is the best way to rotate API keys without causing service downtime?▼

Rotate API keys without downtime by using atomic rotation workflows. This process handles key creation and expiry validation seamlessly, ensuring continuous authentication while minimizing the blast radius of compromised keys.

How does API key auditing work for incident response and compliance?▼

API key auditing captures event logs for creation, rotation, revocation, and last-used metrics. These auditable trails support incident response and compliance requirements by providing visibility into key usage across tenants and users.

Can I restrict API key access using scopes and role-based access control?▼

Yes, you can restrict API key access by assigning per-tenant and per-user scopes. The Skill provides operational guidance for embedding these scoped keys into your services and RBAC workflows to limit access boundaries.

When should I set API key expiry and revocation policies?▼

Set API key expiry and revocation policies to minimize the security blast radius in multi-tenant SaaS environments. Applying expiry validation and supporting immediate revocation ensures compromised or outdated keys cannot be misused.

Related Skills

Explore More Software Engineering Skills→
marquesfelipmarquesfelip

tenant-file-isolation

Design tenant-level file namespace isolation in multi-tenant SaaS object storage.

Community
Advanced
Exia-thdExia-thd

performance-engineer

Profile web applications and generate k6/Artillery load testing scripts.

Community
Advanced
allthingslinuxallthingslinux
1

observability-monitoring-monitor-setup

Implement observability stacks with Prometheus, Grafana, OpenTelemetry, and Alertmanager.

Official
Advanced
sabyunreposabyunrepo

arch-auth

Implement OAuth, JWT, and API key authentication for web applications.

Community
Advanced