Proposed Open Revocable Key Standard (ORKS) Aims to Standardize API Key Revocation

The Problem of Leaked API Keys

API keys frequently appear in public repositories, posing a significant security risk. Unlike OAuth tokens, which have a standardized revocation process (RFC 7009), API keys often lack a clear, programmatic method for revocation. This absence leads to delays in addressing compromised keys, as identifying the issuer and initiating revocation can be a time-consuming manual process, leaving systems vulnerable for extended periods.

Introducing the Open Revocable Key Standard (ORKS)

The Open Revocable Key Standard (ORKS) is a new draft specification designed to address the challenges of API key revocation. The core idea is to embed self-destruct capabilities into API credentials. The proposal is currently available as a draft spec on GitHub.

Key Components of ORKS

ORKS outlines a four-part proposal. First, keys would include a fixed prefix, an encoded issuer domain, the secret, and a checksum (e.g., orks_{issuer}_{secret}_{check}). This structure allows any scanner to immediately identify the key's issuer offline. Second, issuers would host a JSON file at /.well-known/api-key-config, detailing their revocation endpoint, an optional introspection endpoint, security contact information, and supported key constraints. This discoverable kill switch mirrors practices seen in OIDC discovery and security.txt.

Impact and Comparison to Existing Solutions

This standard aims to streamline the revocation process, making it faster and more efficient than current methods. While GitHub's proprietary Secret Scanning Partner Program offers a similar function, ORKS proposes an open, decentralized standard. This would eliminate the need for individual scanning tools to build custom integrations for each provider, fostering a more unified approach to API key security across the industry.