API keys are useful credentials. They are poor accountability systems.
A service can use a key to decide whether a request may reach an API. The key usually cannot explain which agent produced the request, which user or workflow authorized it, or whether the requested action fits the current task.
That distinction matters when several agents share one credential. Rotation and secret scanning reduce exposure, but they do not create agent identity.
Separate service access from agent authority
Production agent systems need at least two decisions:
- May this workload connect to the service?
- May this specific agent perform this action for this purpose now?
An API key can participate in the first decision. The second requires identity, policy, delegation context, and an enforcement point that sees the action before execution.
A safer credential pattern
Use a long-lived platform secret only where it is unavoidable, and keep it out of model context. Exchange it for narrower, short-lived credentials or action tokens when the surrounding platform supports that model.
Bind the narrower credential to:
- an agent identity;
- a tenant and environment;
- an action and resource scope;
- a task or trace identifier;
- an expiration time;
- the identity that delegated authority.
Do not let one agent forward a credential merely because another agent asks for it in natural language. Delegation must be a runtime operation with policy checks, not a prompt convention.
Operational controls
Credential hygiene still matters:
- Store secrets in a dedicated secret manager.
- Prevent secrets from entering prompts, logs, traces, and error messages.
- Scan repositories and build artifacts for accidental disclosure.
- Rotate credentials and revoke them when ownership changes.
- Use different credentials across tenants and environments.
- Alert on unusual scope, volume, geography, or time patterns.
- Deny by default when an agent cannot present the required identity context.
These controls reduce different failure modes. None should be marketed as a guarantee.
The audit boundary
Record the policy decision, agent identity, delegated authority, action, resource, and result for requests processed by the enforcement point. Do not describe that record as a history of every agent action unless every possible execution path is actually intercepted and tested.
The practical rule is simple: an API key tells you which secret was presented. Agent governance must tell you which actor was authorized to do what.