Stats
Actions
Tags
From prodsec-skills
Rejects raw API key authentication in inference engines. Use when designing, reviewing, or auditing authentication for LLM API endpoints.
How this skill is triggered — by the user, by Claude, or both
Slash command
/prodsec-skills:reject-api-keysThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Inference engines MUST reject raw API keys as an authentication mechanism. If legacy interoperability requires API key support, the inference engine (or an API gateway in front of it) MUST proxy and convert API keys into short-lived IdP-issued tokens before processing the request.
Inference engines MUST reject raw API keys as an authentication mechanism. If legacy interoperability requires API key support, the inference engine (or an API gateway in front of it) MUST proxy and convert API keys into short-lived IdP-issued tokens before processing the request.
API keys present significant security risks in production:
When legacy systems require API key authentication:
Client sends API key
→ API Gateway intercepts
→ Gateway exchanges API key for short-lived IdP token
(via client_credentials or token exchange)
→ Gateway forwards IdP token to inference engine
→ Inference engine validates IdP token (never sees API key)
npx claudepluginhub redhatproductsecurity/prodsec-skills --plugin prodsec-skillsAudits API key usage in production AI systems and recommends migrating to short-lived OIDC bearer tokens. Covers credential storage, gateway deployment, and deprecation planning.
Detects inference endpoints missing authentication or rate limiting, enabling model theft via systematic queries. Use when building or auditing LLM-serving infrastructure.
<!-- AUTO-GENERATED by export-plugins.py — DO NOT EDIT -->