API Design · Senior · Question 34 of 75

How can an API minimize the impact of leaked credentials?

✓Correct answer: Scoped, short-lived tokens; key rotation without downtime; secret scanning; per-key monitoring and quick revocation
2Long-lived keys with full access
3Embedding keys in mobile apps

Explanation

Support two active keys per client so they can rotate without an outage.

Further reading

Test yourself

Take the API Design · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.