1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

import crypto from "crypto";
 
interface ApiKeyConfig {
    prefix: string;          // e.g., "sk_live" or "sk_test"
    secretLength: number;    // Bytes of entropy (32 = 256 bits, recommended)
    includeChecksum: boolean;
}
 
interface GeneratedApiKey {
    fullKey: string;         // Complete key to give to user (shown once)
    keyHash: string;         // Store this in database (never store full key)
    prefix: string;          // For identification
    keyId: string;           // Short ID for logging/reference
    createdAt: Date;
}
 
function generateApiKey(config: ApiKeyConfig): GeneratedApiKey {
    // Generate cryptographically secure random bytes
    const randomBytes = crypto.randomBytes(config.secretLength);
    
    // Encode as URL-safe base64 (no +, /, or =)
    const secret = randomBytes
        .toString("base64")
        .replace(/\+/g, "-")
        .replace(/\//g, "_")
        .replace(/=/g, "");
    
    // Construct full key
    const fullKey = `${config.prefix}_${secret}`;
    
    // Generate hash for storage (using SHA-256)
    const keyHash = crypto
        .createHash("sha256")
        .update(fullKey)
        .digest("hex");
    
    // Create short ID for logging (first 8 chars of hash)
    const keyId = keyHash.substring(0, 8);
    
    return {
        fullKey,
        keyHash,
        prefix: config.prefix,
        keyId,
        createdAt: new Date(),
    };
}
 
// Production configuration
const KEY_CONFIGS = {
    live: {
        prefix: "sk_live",
        secretLength: 32,        // 256 bits of entropy
        includeChecksum: false,
    },
    test: {
        prefix: "sk_test",
        secretLength: 32,
        includeChecksum: false,
    },
    publishable: {
        prefix: "pk_live",
        secretLength: 24,        // Less entropy needed (public key)
        includeChecksum: false,
    },
};
 
// Usage example:
// const key = generateApiKey(KEY_CONFIGS.live);
// 
// Response to user (ONLY ONCE):
//   { apiKey: "sk_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2" }
//
// Store in database:
//   { keyHash: "abc123...", prefix: "sk_live", keyId: "abc12345", ... }

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

# Option A: Bearer token (if API key is the sole auth)
GET /api/v1/users HTTP/1.1
Host: api.example.com
Authorization: Bearer sk_live_a1b2c3d4e5f6g7h8
 
# Option B: Custom scheme (clearer intent)
GET /api/v1/users HTTP/1.1
Host: api.example.com
Authorization: ApiKey sk_live_a1b2c3d4e5f6g7h8
 
# Option C: Basic auth (username:password format, common for services)
# Username = API key, Password = empty or additional secret
GET /api/v1/users HTTP/1.1
Host: api.example.com
Authorization: Basic c2tfbGl2ZV9hMWIyYzNkNGU1ZjZnN2g4Og==
# Base64 of "sk_live_a1b2c3d4e5f6g7h8:"

1
2
3
4
5
6
7
8

GET /api/v1/users HTTP/1.1
Host: api.example.com
X-API-Key: sk_live_a1b2c3d4e5f6g7h8
 
# Or company-specific naming:
GET /api/v1/users HTTP/1.1
Host: api.example.com
X-Acme-Api-Key: sk_live_a1b2c3d4e5f6g7h8

1
2
3

# DISCOURAGED - Keys appear in logs, browser history, referrer headers
GET /api/v1/users?api_key=sk_live_a1b2c3d4e5f6g7h8 HTTP/1.1
Host: api.example.com

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

interface KeyExtractionResult {
    key: string | null;
    method: "authorization" | "custom_header" | "query" | null;
    warning: string | null;
}
 
function extractApiKey(request: Request): KeyExtractionResult {
    // Priority 1: Authorization header
    const authHeader = request.headers.get("authorization");
    if (authHeader) {
        // Bearer token
        if (authHeader.toLowerCase().startsWith("bearer ")) {
            return {
                key: authHeader.substring(7).trim(),
                method: "authorization",
                warning: null,
            };
        }
        
        // ApiKey scheme
        if (authHeader.toLowerCase().startsWith("apikey ")) {
            return {
                key: authHeader.substring(7).trim(),
                method: "authorization",
                warning: null,
            };
        }
        
        // Basic auth
        if (authHeader.toLowerCase().startsWith("basic ")) {
            const decoded = Buffer.from(authHeader.substring(6), "base64").toString();
            const [username, password] = decoded.split(":");
            return {
                key: username,  // API key as username
                method: "authorization",
                warning: null,
            };
        }
    }
    
    // Priority 2: X-API-Key header
    const apiKeyHeader = request.headers.get("x-api-key");
    if (apiKeyHeader) {
        return {
            key: apiKeyHeader.trim(),
            method: "custom_header",
            warning: null,
        };
    }
    
    // Priority 3: Query parameter (discouraged, with warning)
    const url = new URL(request.url);
    const queryKey = url.searchParams.get("api_key") || 
                     url.searchParams.get("apiKey") ||
                     url.searchParams.get("key");
    if (queryKey) {
        return {
            key: queryKey,
            method: "query",
            warning: "API key passed in query parameter - consider using headers",
        };
    }
    
    return { key: null, method: null, warning: null };
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

interface ApiKeyMetadata {
    keyId: string;
    accountId: string;
    organizationId: string;
    environment: "live" | "test";
    scopes: string[];
    rateLimits: {
        requestsPerMinute: number;
        requestsPerDay: number;
    };
    status: "active" | "revoked" | "expired";
    createdAt: Date;
    expiresAt: Date | null;
    lastUsed: Date | null;
}
 
class ApiKeyValidator {
    private cache: LRUCache<string, ApiKeyMetadata | null>;
    
    constructor(
        private database: KeyDatabase,
        private redis: Redis,
        config: ValidatorConfig
    ) {
        // Local LRU cache for hot keys
        this.cache = new LRUCache({
            max: config.localCacheSize || 10000,
            ttl: config.localCacheTtl || 60000,  // 1 minute
        });
    }
    
    async validate(apiKey: string): Promise<ApiKeyMetadata | null> {
        // Step 1: Hash the key for lookup (never query with plain key)
        const keyHash = this.hashKey(apiKey);
        
        // Step 2: Check local LRU cache
        const localCached = this.cache.get(keyHash);
        if (localCached !== undefined) {
            // Cache hit (even if null = key doesn't exist)
            return localCached;
        }
        
        // Step 3: Check distributed cache (Redis)
        const redisCached = await this.redis.get(`apikey:${keyHash}`);
        if (redisCached) {
            const metadata = JSON.parse(redisCached) as ApiKeyMetadata;
            this.cache.set(keyHash, metadata);
            return metadata;
        }
        
        // Step 4: Query database
        const metadata = await this.database.getKeyByHash(keyHash);
        
        if (metadata) {
            // Cache for future requests
            await this.redis.setex(
                `apikey:${keyHash}`,
                300,  // 5 minute TTL
                JSON.stringify(metadata)
            );
            this.cache.set(keyHash, metadata);
            
            // Async: Update last used timestamp
            this.updateLastUsed(keyHash).catch(console.error);
            
        } else {
            // Cache negative result briefly to prevent enumeration attacks
            this.cache.set(keyHash, null);
            await this.redis.setex(`apikey:${keyHash}`, 60, "null");
        }
        
        return metadata;
    }
    
    private hashKey(apiKey: string): string {
        // Use SHA-256 for consistent hashing
        return crypto
            .createHash("sha256")
            .update(apiKey)
            .digest("hex");
    }
    
    private async updateLastUsed(keyHash: string): Promise<void> {
        // Batch updates to reduce database load
        // Only update if not updated in the last hour
        const lastUpdate = await this.redis.get(`apikey:lastupdate:${keyHash}`);
        if (!lastUpdate) {
            await this.database.updateLastUsed(keyHash, new Date());
            await this.redis.setex(`apikey:lastupdate:${keyHash}`, 3600, "1");
        }
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

import crypto from "crypto";
 
/**
 * Constant-time string comparison to prevent timing attacks.
 * 
 * Timing attacks work by measuring how long comparison takes.
 * Standard string comparison (===) returns false as soon as a
 * mismatch is found, revealing information about the secret.
 */
function constantTimeCompare(a: string, b: string): boolean {
    // Convert to buffers for crypto.timingSafeEqual
    const bufferA = Buffer.from(a);
    const bufferB = Buffer.from(b);
    
    // Must be same length for timingSafeEqual
    if (bufferA.length !== bufferB.length) {
        // Still compare against a dummy to maintain constant time
        const dummy = Buffer.alloc(bufferA.length);
        crypto.timingSafeEqual(bufferA, dummy);
        return false;
    }
    
    return crypto.timingSafeEqual(bufferA, bufferB);
}
 
// For hash comparison (preferred - compare hashes, not keys)
function validateKeyByHash(
    providedKey: string,
    storedHash: string
): boolean {
    const providedHash = crypto
        .createHash("sha256")
        .update(providedKey)
        .digest("hex");
    
    return constantTimeCompare(providedHash, storedHash);
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138

interface RateLimitConfig {
    limits: RateLimitRule[];
    headers: {
        includeRemaining: boolean;
        includeReset: boolean;
    };
}
 
interface RateLimitRule {
    dimension: "key" | "account" | "ip" | "endpoint";
    period: "second" | "minute" | "hour" | "day";
    limit: number;
    burstLimit?: number;  // Briefly exceed base limit
}
 
interface RateLimitResult {
    allowed: boolean;
    remaining: number;
    resetAt: Date;
    retryAfter?: number;  // Seconds until retry
    limitExceeded?: {
        dimension: string;
        limit: number;
        current: number;
    };
}
 
class RateLimiter {
    constructor(private redis: Redis) {}
    
    async checkRateLimit(
        keyMetadata: ApiKeyMetadata,
        request: Request
    ): Promise<RateLimitResult> {
        const now = Date.now();
        const results: RateLimitResult[] = [];
        
        // Check all applicable limits
        const limits = keyMetadata.rateLimits;
        
        // Per-key per-minute limit
        results.push(await this.checkLimit({
            key: `ratelimit:key:${keyMetadata.keyId}:minute`,
            limit: limits.requestsPerMinute,
            windowMs: 60000,
            now,
        }));
        
        // Per-account daily limit
        results.push(await this.checkLimit({
            key: `ratelimit:account:${keyMetadata.accountId}:day`,
            limit: limits.requestsPerDay,
            windowMs: 86400000,
            now,
        }));
        
        // Per-endpoint limit (if configured)
        const endpoint = this.extractEndpoint(request);
        const endpointLimit = this.getEndpointLimit(endpoint);
        if (endpointLimit) {
            results.push(await this.checkLimit({
                key: `ratelimit:key:${keyMetadata.keyId}:endpoint:${endpoint}:minute`,
                limit: endpointLimit,
                windowMs: 60000,
                now,
            }));
        }
        
        // Return the most restrictive result
        const failedResult = results.find(r => !r.allowed);
        if (failedResult) {
            return failedResult;
        }
        
        // Return combined result (minimum remaining)
        const minRemaining = Math.min(...results.map(r => r.remaining));
        const earliestReset = new Date(Math.min(...results.map(r => r.resetAt.getTime())));
        
        return {
            allowed: true,
            remaining: minRemaining,
            resetAt: earliestReset,
        };
    }
    
    private async checkLimit(params: {
        key: string;
        limit: number;
        windowMs: number;
        now: number;
    }): Promise<RateLimitResult> {
        const { key, limit, windowMs, now } = params;
        const windowStart = now - windowMs;
        
        // Use sliding window with Redis sorted set
        const pipeline = this.redis.pipeline();
        
        // Remove old entries
        pipeline.zremrangebyscore(key, 0, windowStart);
        
        // Count current entries
        pipeline.zcard(key);
        
        // Add new entry
        pipeline.zadd(key, now.toString(), `${now}:${crypto.randomUUID()}`);
        
        // Set expiry
        pipeline.pexpire(key, windowMs);
        
        const results = await pipeline.exec();
        const currentCount = (results?.[1]?.[1] as number) || 0;
        
        if (currentCount >= limit) {
            // Get oldest entry to calculate reset time
            const oldest = await this.redis.zrange(key, 0, 0, "WITHSCORES");
            const oldestTimestamp = parseInt(oldest[1] || String(now));
            const resetAt = new Date(oldestTimestamp + windowMs);
            
            return {
                allowed: false,
                remaining: 0,
                resetAt,
                retryAfter: Math.ceil((resetAt.getTime() - now) / 1000),
                limitExceeded: {
                    dimension: key,
                    limit,
                    current: currentCount,
                },
            };
        }
        
        return {
            allowed: true,
            remaining: limit - currentCount - 1,  // -1 for this request
            resetAt: new Date(now + windowMs),
        };
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

HTTP/1.1 200 OK
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 842
X-RateLimit-Reset: 1704067260
 
# When limit exceeded:
HTTP/1.1 429 Too Many Requests
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1704067260
Retry-After: 45
Content-Type: application/json
 
{
  "error": {
    "code": "rate_limit_exceeded",
    "message": "Rate limit exceeded. Please retry after 45 seconds.",
    "details": {
      "limit": 1000,
      "window": "minute",
      "reset_at": "2024-01-01T00:01:00Z"
    }
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122

interface KeyValidationResult {
    valid: boolean;
    status: "active" | "deprecated" | "revoked" | "expired" | "not_found";
    metadata?: ApiKeyMetadata;
    warning?: string;
    headers?: Record<string, string>;
}
 
function validateKeyStatus(metadata: ApiKeyMetadata | null): KeyValidationResult {
    if (!metadata) {
        return {
            valid: false,
            status: "not_found",
        };
    }
    
    const now = new Date();
    
    // Revoked keys are immediately rejected
    if (metadata.status === "revoked") {
        return {
            valid: false,
            status: "revoked",
            headers: {
                "X-Key-Status": "revoked",
            },
        };
    }
    
    // Check expiration
    if (metadata.expiresAt && metadata.expiresAt < now) {
        return {
            valid: false,
            status: "expired",
            headers: {
                "X-Key-Status": "expired",
                "X-Key-Expired-At": metadata.expiresAt.toISOString(),
            },
        };
    }
    
    // Check if approaching expiration (deprecation warning)
    if (metadata.expiresAt) {
        const daysUntilExpiry = (metadata.expiresAt.getTime() - now.getTime()) / 86400000;
        
        if (daysUntilExpiry <= 30) {
            return {
                valid: true,
                status: "deprecated",
                metadata,
                warning: `API key expires in ${Math.ceil(daysUntilExpiry)} days`,
                headers: {
                    "X-Key-Status": "deprecated",
                    "X-Key-Expires-At": metadata.expiresAt.toISOString(),
                    "Deprecation": metadata.expiresAt.toISOString(),
                },
            };
        }
    }
    
    // Active key
    return {
        valid: true,
        status: "active",
        metadata,
        headers: {
            "X-Key-Status": "active",
        },
    };
}
 
// Gateway middleware applying status validation
async function apiKeyMiddleware(request: Request): Promise<Response | null> {
    const { key, method, warning: extractionWarning } = extractApiKey(request);
    
    if (!key) {
        return new Response(JSON.stringify({
            error: {
                code: "missing_api_key",
                message: "API key required",
            },
        }), {
            status: 401,
            headers: { "Content-Type": "application/json" },
        });
    }
    
    const metadata = await validator.validate(key);
    const validation = validateKeyStatus(metadata);
    
    if (!validation.valid) {
        return new Response(JSON.stringify({
            error: {
                code: `api_key_${validation.status}`,
                message: getStatusMessage(validation.status),
            },
        }), {
            status: 401,
            headers: { 
                "Content-Type": "application/json",
                ...validation.headers,
            },
        });
    }
    
    // Key is valid - add headers and continue
    if (validation.headers) {
        for (const [key, value] of Object.entries(validation.headers)) {
            request.headers.set(key, value);
        }
    }
    
    // Log deprecation warnings
    if (validation.warning) {
        console.warn(`API key deprecation: ${validation.warning}`, {
            keyId: metadata?.keyId,
            accountId: metadata?.accountId,
        });
    }
    
    return null;  // Continue to next middleware
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

async function rotateApiKey(
    accountId: string,
    existingKeyId: string,
    options: RotationOptions = {}
): Promise<KeyRotationResult> {
    const {
        deprecationPeriodDays = 30,
        notifyWebhook = true,
    } = options;
    
    // Step 1: Verify existing key belongs to account
    const existingKey = await database.getKey(existingKeyId);
    if (!existingKey || existingKey.accountId !== accountId) {
        throw new Error("Key not found or access denied");
    }
    
    // Step 2: Generate new key
    const newKey = generateApiKey({
        prefix: existingKey.environment === "live" ? "sk_live" : "sk_test",
        secretLength: 32,
        includeChecksum: false,
    });
    
    // Step 3: Store new key
    await database.createKey({
        keyHash: newKey.keyHash,
        keyId: newKey.keyId,
        accountId: accountId,
        environment: existingKey.environment,
        scopes: existingKey.scopes,
        rateLimits: existingKey.rateLimits,
        status: "active",
        createdAt: new Date(),
        expiresAt: null,
        rotatedFrom: existingKeyId,
    });
    
    // Step 4: Deprecate old key
    const deprecationDate = new Date(
        Date.now() + (deprecationPeriodDays * 86400000)
    );
    await database.updateKey(existingKeyId, {
        status: "deprecated",
        expiresAt: deprecationDate,
    });
    
    // Step 5: Invalidate caches
    await redis.del(`apikey:${existingKey.keyHash}`);
    
    // Step 6: Notify
    if (notifyWebhook) {
        await notificationService.sendKeyRotation({
            accountId,
            oldKeyId: existingKeyId,
            newKeyId: newKey.keyId,
            deprecationDate,
        });
    }
    
    // Audit log
    await auditLog.record({
        action: "api_key.rotated",
        actor: { type: "account", id: accountId },
        resource: { type: "api_key", id: existingKeyId },
        metadata: {
            newKeyId: newKey.keyId,
            deprecationPeriodDays,
        },
    });
    
    return {
        newKey: {
            id: newKey.keyId,
            fullKey: newKey.fullKey,  // Only time full key is exposed
            createdAt: newKey.createdAt,
        },
        oldKey: {
            id: existingKeyId,
            expiresAt: deprecationDate,
        },
    };
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108

interface AnomalyDetectionConfig {
    // Geographic anomaly
    geo: {
        enabled: boolean;
        baselineCountries: string[];
        alertOnNew: boolean;
    };
    
    // Usage pattern anomaly
    usage: {
        enabled: boolean;
        baselineRequestsPerHour: number;
        anomalyThreshold: number;  // Multiplier (e.g., 10x normal)
    };
    
    // Time-based anomaly
    temporal: {
        enabled: boolean;
        baselineHours: number[];  // Expected hours (0-23)
        alertOnOffHours: boolean;
    };
}
 
class KeyAnomalyDetector {
    async checkForAnomalies(
        keyMetadata: ApiKeyMetadata,
        request: Request
    ): Promise<AnomalyAlert[]> {
        const alerts: AnomalyAlert[] = [];
        const keyUsage = await this.getKeyUsageProfile(keyMetadata.keyId);
        
        // Geographic anomaly
        const requestCountry = this.getCountryFromIP(request);
        if (requestCountry && !keyUsage.countries.includes(requestCountry)) {
            alerts.push({
                type: "geographic_anomaly",
                severity: "medium",
                message: `Request from new country: ${requestCountry}`,
                metadata: {
                    newCountry: requestCountry,
                    knownCountries: keyUsage.countries,
                },
            });
        }
        
        // Usage spike detection
        const recentRate = await this.getRecentRequestRate(keyMetadata.keyId);
        if (recentRate > keyUsage.averageRequestsPerHour * 10) {
            alerts.push({
                type: "usage_spike",
                severity: "high",
                message: `Request rate spike: ${recentRate}/hour vs ${keyUsage.averageRequestsPerHour}/hour average`,
                metadata: {
                    currentRate: recentRate,
                    averageRate: keyUsage.averageRequestsPerHour,
                },
            });
        }
        
        // Off-hours activity
        const hour = new Date().getUTCHours();
        if (!keyUsage.activeHours.includes(hour)) {
            alerts.push({
                type: "temporal_anomaly",
                severity: "low",
                message: `Request outside normal hours (UTC ${hour}:00)`,
                metadata: {
                    currentHour: hour,
                    normalHours: keyUsage.activeHours,
                },
            });
        }
        
        // Log alerts
        for (const alert of alerts) {
            await this.recordAlert(keyMetadata.keyId, alert);
        }
        
        return alerts;
    }
    
    async handleSuspiciousActivity(
        keyMetadata: ApiKeyMetadata,
        alerts: AnomalyAlert[]
    ): Promise<SecurityAction> {
        const severity = Math.max(...alerts.map(a => 
            a.severity === "critical" ? 4 :
            a.severity === "high" ? 3 :
            a.severity === "medium" ? 2 : 1
        ));
        
        if (severity >= 4) {
            // Critical: Auto-revoke and notify
            await this.revokeKey(keyMetadata.keyId, "automatic_security");
            await this.notifySecurityTeam(keyMetadata, alerts);
            return { action: "revoke", reason: "critical_security_alert" };
        }
        
        if (severity >= 3) {
            // High: Notify and add friction
            await this.notifyKeyOwner(keyMetadata, alerts);
            return { action: "throttle", reason: "high_security_alert" };
        }
        
        // Medium/Low: Log only
        return { action: "allow", reason: "below_action_threshold" };
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

// Patterns for API keys to redact from logs
const KEY_PATTERNS = [
    /sk_live_[a-zA-Z0-9_-]{20,}/g,
    /sk_test_[a-zA-Z0-9_-]{20,}/g,
    /pk_live_[a-zA-Z0-9_-]{20,}/g,
    /Bearer [a-zA-Z0-9._-]{40,}/g,
];
 
function redactSensitiveData(logEntry: string): string {
    let redacted = logEntry;
    
    for (const pattern of KEY_PATTERNS) {
        redacted = redacted.replace(pattern, (match) => {
            const prefix = match.substring(0, 8);
            return `${prefix}[REDACTED]`;
        });
    }
    
    return redacted;
}
 
// Custom logger that redacts before output
const secureLogger = {
    info: (message: string, ...args: any[]) => {
        console.log(redactSensitiveData(message), ...args.map(arg => 
            typeof arg === "string" ? redactSensitiveData(arg) : arg
        ));
    },
    // ... other log levels
};