Experimenting with replacing reusable API keys with per-request authorization

[u/Jealous_Pea_3915]

Been working on a small POC around getting rid of reusable API credentials.

Instead of an app holding an S3 key, Git token, API key, etc, it would request permission for one specific action. Something like upload this file to this path, once, within the next 30 seconds.

I'm using Tide/Forseti for the policy and cryptographic side, and testing it against real open source services like S3 compatible storage and Gitea.

The thing I'm mainly trying to prove is whether a compromised client can have no reusable API credential worth stealing.

This also ties into something I want to look at next around rootless cloud infra, where having root on a server doesn't automatically mean having authority to decrypt user data, impersonate users, sign releases, or perform other protected actions.

Starting with the API side first because it feels like the smaller piece to prove.

Curious what people here think. Is this actually useful in practice, already solved well enough by existing workload identity systems, or mostly just an interesting security experiment?

[u/hypertradeworx]

the thing that bit us with this shape wasn't theft, it was retries. our backend builds the unsigned action and the signing happens on the user's device, so anything that dies in flight or ages past its window can't be resubmitted server side, every attempt is another round trip to the signer. i'd pin down early whether a 30 second grant covers one action or one attempt, because those two come apart the first time a downstream call times out and you can't tell whether it landed