API Key Management

Overview#

Argus provides comprehensive API key management that enables secure programmatic access to your platform resources. The system handles the full lifecycle of API keys -- from secure generation through rotation, revocation, and destruction -- while enforcing fine-grained permissions, conditional access policies, and usage quotas to ensure every integration operates with least-privilege access.

Key Features#

• Secure Key Generation - API keys are generated using cryptographically secure methods with high entropy, ensuring uniqueness and resistance to brute-force attacks. Key secrets are displayed only once at creation time and are stored in hashed form.

• Multiple Authentication Methods - Support for standard bearer tokens, signed JWT tokens, OAuth 2.0 client credentials, and mutual TLS certificate authentication to match your integration requirements and security posture.

• Automatic Key Rotation - Configurable rotation schedules with grace periods ensure keys are regularly refreshed without service interruption. Both old and new keys remain valid during the transition period for zero-downtime rotation.

• Granular Scope and Permissions - Hierarchical permission model controls access at the organization, project, and resource level. Each key can be scoped to specific resources and actions, enforcing least-privilege principles.

• Conditional Access Policies - Restrict key usage based on IP allowlists, geographic location, time-of-day windows, network type, and device compliance to reduce the attack surface of each integration.

• Rate Limiting and Quota Management - Configurable usage quotas with multiple rate limiting strategies prevent abuse while accommodating legitimate traffic patterns. Burst allowances handle temporary spikes gracefully.

• Usage Analytics and Anomaly Detection - Monitor key usage patterns with detailed analytics including request volumes, geographic distribution, error rates, and anomaly detection that identifies potentially compromised keys.

How It Works#

Key Lifecycle#

1. Creation - Keys are generated with specified scopes, rate limits, and conditions. The secret value is displayed once and must be securely stored by the integrator. Integration guidance and example code are provided automatically.

2. Active Usage - Each API request is validated against the key's scopes, conditions, and rate limits. Usage metrics are collected continuously and checked against anomaly baselines.

3. Rotation - Keys can be rotated on a schedule or on demand. During rotation, a new key is generated and both old and new keys are accepted for a configurable grace period. Proactive notifications alert key owners before scheduled rotations.

4. Revocation - Keys can be immediately revoked with global propagation, removing all access within seconds. Revocation triggers include manual action, security threat detection, or policy violations.

Permission Model#

Keys support a hierarchical scope architecture:

• Resource-based scoping controls which data types the key can access (e.g., investigations, evidence, users)
• Action-level permissions control what operations are allowed (read, write, delete, execute, admin)
• Conditional policies add context-based restrictions (IP ranges, geography, time windows, network requirements)
• Hierarchical inheritance allows organization-level keys to delegate subsets of their permissions

Rate Limiting#

Multiple rate limiting strategies are available to match your needs:

• Fixed window for straightforward billing-based quotas
• Sliding window for smooth enforcement without boundary gaming
• Token bucket for natural accommodation of traffic spikes
• Cost-based quotas where different operations consume different amounts of quota

Compliance#

API key management supports compliance with:

• SOC 2 - Complete audit trail of key lifecycle events, access controls, and usage monitoring
• ISO 27001 - Information security controls for authentication and access management
• PCI-DSS - Secure credential management for cardholder data environments
• GDPR - Access controls and audit logging for personal data processing

Availability#

• Enterprise Plan: Included with full feature set
• Professional Plan: Included with standard rate limits

Last Reviewed: 2026-02-05