Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/xalgorix/xalgorix/implementing-api-key-security-controlsnpx skills add xalgorix/xalgorix --skill implementing-api-key-security-controlsgit clone --depth 1 https://github.com/xalgorix/xalgorixWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xalgorix/xalgorix/implementing-api-key-security-controls)<a href="https://agentmods.dev/skills/xalgorix/xalgorix/implementing-api-key-security-controls"><img src="https://agentmods.dev/badge/skills/xalgorix/xalgorix/implementing-api-key-security-controls.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00098 | $0.03833 |
| Opus 5 | $0.00049 | $0.01917 |
| Sonnet 5 | $0.00020 | $0.00767 |
| Haiku 4.5 | $0.00010 | $0.00383 |
Grade B, and why
implementing-api-key-security-controls scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Harvests environment variablesmediumData exfiltration
Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.
# Extract API key from header Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 421 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Implementing API Key Security Controls
When to Use
- Designing secure API key generation with sufficient entropy and identifiable prefixes for leak detection
- Implementing server-side API key hashing (never storing keys in plaintext) with SHA-256 or bcrypt
- Building key rotation workflows that allow zero-downtime key replacement for API consumers
- Configuring per-key scoping to limit each API key to specific endpoints, IP ranges, and rate limits
- Setting up automated monitoring for API key leakage in GitHub repos, logs, and client-side code
Do not use API keys as the sole authentication mechanism for user-facing applications. API keys are best suited for server-to-server communication and developer access.
Common Misconfigurations & Verification
- Plaintext/at-rest storage: keys stored unhashed (or reversibly) leak wholesale on DB compromise - store SHA-256 hashes only.
- No identifiable prefix: without a
sk_live_-style prefix, secret scanners and gitleaks cannot catch leaked keys. - Keys in URLs: accepting keys in query params leaks them to logs, browser history, and Referer headers - require a header instead.
- No scoping/expiry: unscoped, non-expiring keys give a single leak full, permanent blast radius; enforce per-key scopes, IP allowlists, and TTL.
- No per-key rate limit: one compromised key can abuse the entire API.
- Rotation without grace period: hard-cutover rotation breaks consumers, which discourages rotation entirely.
How to verify it works: confirm the DB column holds only hashes (no recoverable key); submit a revoked key and confirm immediate rejection (cache invalidated); plant a prefixed test key in a repo and confirm the scanner/auto-revoke fires; call an out-of-scope endpoint or non-allowlisted IP with a scoped key and confirm 403; exceed the per-key limit and confirm throttling.
Prerequisites
- Secure random number generator (os.urandom, secrets module) for key generation
- Database with proper encryption at rest for storing hashed API keys
- Redis or similar store for key-to-metadata caching and rate limiting
- Secret scanning tools (GitHub secret scanning, truffleHog, gitleaks)
- Monitoring and alerting infrastructure for key usage anomalies
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 421 lines · 98 tokens per session scan B 143817b6adc6
implementing-api-key-security-controls is a skill published in the GitHub repository xalgorix/xalgorix (955 stars, last pushed today), licensed Apache-2.0. It adds 98 tokens to every session and 3,833 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it B with 1 finding (harvests environment variables). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
implementing-api-key-security-controls
Implements secure API key generation, storage, rotation, and revocation controls to protect API authentication credentials from leakage, brute force, and abuse. The engineer designs API key formats with sufficient entropy, implements secure hashing for storage, enforces per-key scoping and rate limiting, monitors for…
implementing-api-key-security-controls
Implements secure API key generation, storage, rotation, and revocation controls to protect API authentication credentials from leakage, brute force, and abuse. The engineer designs API key formats with sufficient entropy, implements secure hashing for storage, enforces per-key scoping and rate limiting, monitors for…
analyzing-api-gateway-access-logs
Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.
conducting-api-security-testing
Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom…
bugbountyrules
Use for ANY bug bounty, penetration test, or web/API/mobile security assessment: recon, testing endpoints, analyzing Burp traffic or any bug-bounty platform's MCP (HackerOne, Intigriti, Bugcrowd, YesWeHack, Immunefi), reviewing APKs, bypassing a WAF, enforcing scope, hunting a specific vuln class, validating findings…
insecure-direct-object-reference-idor
Identify and exploit Insecure Direct Object Reference (IDOR), or Broken Object Level Authorization (BOLA), vulnerabilities. Manipulate internal identifiers (e.g., user IDs, database primary keys, transaction IDs) within HTTP request parameters or API payloads to unauthorizedly access, modify, or delete data belonging…