https://nalar.dev/tags/api-security/ Recent content in API Security on Nalar Hugo en-us Mon, 07 Sep 2026 00:00:00 +0700 https://nalar.dev/store-api-keys-as-verifiers-not-recoverable-secrets/ Mon, 07 Sep 2026 00:00:00 +0700 https://nalar.dev/store-api-keys-as-verifiers-not-recoverable-secrets/ <p>An API key is often treated like a password: a client presents a secret string, and the server decides whether that string represents an authorized caller. Yet many systems store API keys in plaintext because the application needs to compare them later.</p> <p>That design creates an avoidable consequence. If an attacker obtains the credential database, every stored plaintext key may immediately become a usable credential. The database leak becomes an authentication compromise as well as a data leak.</p>