Skip to content
Deepak Gupta markTech Graveyard

Tech Graveyard/infrastructure

Static API Keys (1998 to Dying)

When one company runs 10,000 ephemeral AI agents, static API keys stop being a security gap and start being a security crisis.

Born 1998 · Still dying, projected end 2028 · Status: dying

By Deepak Gupta · Published · Last updated

Paired prediction: what replaces it in Future Tech

Certificate of Death

Name of decedent

Static API Keys

Born
1998
Died
Not yet
Age
28+

Cause of death

AI agent proliferation is making unscoped long-lived secrets impossible to govern

Survived by

SPIFFE/SPIRE, workload identity federation, short-lived JWTs, mTLS

Invented by

Early SOAP and REST API designers

Status: DyingProjected final breath: 2028

Filed by D. Gupta · guptadeepak.com

The hook

GitHub detected more than 1 million leaked secrets in public repos in the first eight weeks of 2024, more than a dozen a minute. The fix is not better scanning. It is making the secret short-lived enough that the leak does not matter.

Thesis. Static API keys worked for 25 years because the blast radius was bounded. AI agents are breaking that boundary.

The story

The origin

REST APIs needed simple auth. The API key was the path of least resistance. Stripe, which launched publicly in 2011, popularized the model for developer-facing SaaS, and every developer-facing API copied the pattern: a long random string, scope-less, valid until manually revoked.

The peak

By 2018 every SaaS product had API key authentication and a 'keep this secret' warning in the docs that nobody followed. The keys ended up in committed code, CI environment variables, Slack messages, screenshots in support tickets.

The leak epidemic

GitGuardian counted 12.8 million new secrets exposed on public GitHub in 2023 and 23.8 million in 2024. Private repos add more. Its 2025 report found 70% of secrets leaked in 2022 were still valid. Breaches involving exposed credentials include Uber in 2022 and CircleCI in 2023.

The AI multiplier

When an enterprise deploys 10,000 AI agents, each needing access to multiple services, static keys become ungovernable. The volume crosses the threshold where individual key management collapses.

The replacement

Workload identity federation. Short-lived tokens issued per request. SPIFFE/SPIRE for cross-cluster identity. mTLS for service-to-service. The replacement is mature; what is missing is the migration tooling.

Key data points

  • GitGuardian State of Secrets Sprawl 2025: 23.8M secrets leaked on public GitHub in 2024
  • GitHub: 1M+ leaked secrets in public repos in the first eight weeks of 2024
  • SPIFFE/SPIRE: CNCF graduated 2022
  • Breaches involving exposed secrets: Uber 2022, CircleCI 2023

Contrarian angle

Secret scanning tools are a profitable industry built on top of a broken model. The right move is not better scanning. The right move is making secrets that cannot be useful when leaked.

The flip side

What replaces it

The paired prediction in Future Tech.

Read the prediction

◆ Technology Rewired

See the full evolution in Technology Rewired:

FAQ

Are personal access tokens the same problem?

Yes. PATs are static API keys with a fancier UI. The same blast-radius issues apply. GitHub has started shipping fine-grained PATs with expiration, which is the right direction.

How do AI agents get identities if not through API keys?

Workload identity federation. The agent runtime presents a verifiable attestation (cloud IAM token, OIDC claim) and exchanges it for a short-lived credential scoped to the specific tool call.

Is OAuth client_secret a 'static API key'?

Functionally yes, when it is long-lived. FAPI 2.0 requires private_key_jwt or mutual TLS client authentication instead of shared secrets, for exactly this reason. Short token lifetimes do the rest.

More from guptadeepak.com

Further reading

Related obituaries

More from the infrastructure graveyard.