back
2 comments
> a good practice to minimize damage is to routinely cycle API keys.

Anyone have a good measure for how frequently this should be done? Too frequently is too much toil and infrequently is a security risk.

Keys of higher risk should be done more frequently. How frequently is more a matter of risk (is your company a target?) + engineering bandwidth to do it.

All keys should at least be refreshed once a year. At least.

It's worth mentioning that refreshing keys could also introduce security risks if you don't have a defined process. For instance, if an engineer is consistently emailing new keys to another engineer, that's probably (most definitely) a bad idea.