An API key that can do everything is a key you cannot hand out

You choose the permissions when you create it, from the same catalogue as roles. A key made to push contacts from your website cannot read your invoices, and the refusal comes from the gateway, not from a coding convention. It is the model of Stripe's restricted keys and GitHub's fine-grained tokens.

• Permissions chosen from the RBAC catalogue
• Checked on every call, at the gateway
• Secret key or public key, depending on use
• Label and note, so you know what it is for

A key can carry an end date. And even without one, a ninety-day inactivity window applies: a key nobody uses any more stops working on its own. This is the most ordinary leak of all — a key dropped into a script one Tuesday and forgotten for three years.

• Explicit expiry date, if you want one
• Ninety-day inactivity window on top
• Date of last use shown
• Immediate revocation, with who revoked it

The key in clear exists only at the moment you create it: after that only its fingerprint is kept, and nothing can read it back — not the interface, not support, not the audit log, which records the event without ever carrying the value. If it is lost, you create another and revoke the old one.

• Value shown once, never stored in clear
• Audit log with no secret and no fingerprint
• Email alert on an IP address never seen before
• Creation and revocation attributed to their author