What is an API key?
An API key is a secret token that identifies and authorizes a program calling an API. Keys a service issues to its customers should be stored hashed, like passwords. Keys a service holds for third parties belong in a secrets manager.
What the buyer is really asking
There are two kinds of keys here: the API keys you issue to the buyer and the keys you hold for third-party services. Buyers hope to hear that issued keys are hashed and held keys are kept in a secrets manager.
Other ways buyers ask it
Every one of these wants the same answer:
- “How do you store API keys?”
- “Are API keys hashed or encrypted?”
- “Can API keys be rotated or revoked?”
Evidence to have ready
- How issued API keys are stored and displayed
- The secrets manager holding third-party keys
How Tyrvar answers this
Tyrvar treats every wording above as one question. You write the answer once, attach the evidence, and revisit it when your setup changes. Each buyer gets that approved answer no matter how their questionnaire words it. If you have not answered it yet, Tyrvar flags the question for you and does not make something up. Try it on your own questionnaire.