API Security

Store API Keys as Verifiers, Not Recoverable Secrets

An API key is often treated like a password: a client presents a secret string, and the server decides whether that string represents an authorized caller. Yet many systems store API keys in plaintext because the application needs to compare them later. That design creates an avoidable consequence. If an attacker obtains the credential database, every stored plaintext key may immediately become a usable credential. The database leak becomes an authentication compromise as well as a data leak.