Credential & Access Lifecycle

30 articles / Page 2 of 2

1. Credential & Access LifecycleUpdated 2026-10-31

   Store API Key Verifiers Safely

   Store API key identifiers and non-recoverable verifiers when the service only needs to check a presented key.

2. Credential & Access LifecycleUpdated 2026-10-31

   Triage an Exposed Secret

   Contain an exposed credential by identifying its provider, scope, possible use, replacement path, and revocation evidence.

3. Credential & Access LifecycleUpdated 2026-10-31

   Validate JWT Issuer and Audience

   Reject JWTs from the wrong issuer or for another API, even when the signature and token lifetime are otherwise valid.

4. Credential & Access LifecycleUpdated 2026-10-31

   Verify Copied Key Revocation

   Confirm that a copied API key is invalid at its provider, while the replacement credential still serves each authorized caller.

5. Credential & Access LifecycleUpdated 2026-10-31

   Verify Credential Replacement

   Prove that a replacement credential works for every intended caller while the retired key fails at the issuing provider.

6. Credential & Access LifecycleUpdated 2026-10-31

   Verify MFA Recovery Paths

   Test account recovery when an MFA factor is lost without letting support or backup codes bypass normal identity checks.