Api Key Management
- 16 installs
- 1 repo stars
- Updated March 10, 2026
- davidcastagnetoa/skills
Authenticate server-to-server B2B clients with hashed API keys, scopes, per-key rate limiting, and graceful rotation, validated at the gateway via Redis.
About
Manages API keys for server-to-server client authentication, storing SHA-256 hashes with scopes and validating them at the gateway against a Redis cache. A developer uses it to authenticate B2B backends alongside JWT for mobile/web clients.
- Stores SHA-256 key hashes with scopes and expiry in Postgres
- Per-key rate limiting and rotation with a dual-active grace period
Api Key Management by the numbers
- 16 all-time installs (skills.sh)
- Ranked #1,612 of 2,203 Security skills by installs in the Skillselion catalog
- Data as of Jul 29, 2026 (Skillselion catalog sync)
npx skills add https://github.com/davidcastagnetoa/skills --skill api_key_managementAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 16 |
|---|---|
| repo stars | ★ 1 |
| Last updated | March 10, 2026 |
| Repository | davidcastagnetoa/skills ↗ |
What it does
Authenticate server-to-server B2B clients with hashed API keys, scopes, per-key rate limiting, and graceful rotation, validated at the gateway via Redis.
Files
api_key_management
Gestión de API Keys para autenticación de clientes server-to-server (backends de terceros que integran el sistema KYC). Complementa JWT para clientes móviles/web.
When to use
Usar en el api_gateway_agent para autenticar peticiones de clientes B2B que integran la API de verificación. Los clientes móviles/web usan JWT; los backends externos usan API Keys.
Instructions
1. Generar API Keys con secrets.token_urlsafe(32) — mínimo 256 bits de entropía. 2. Almacenar hash SHA-256 de la key en PostgreSQL: api_keys(key_hash, client_id, scopes, created_at, expires_at). 3. El cliente envía la key en header: X-API-Key: <key>. 4. Nginx valida contra Redis (cache de keys activas): redis.sismember('active_api_keys', sha256(key)). 5. Implementar rate limiting por API Key además de por IP. 6. Rotación: emitir nueva key, período de gracia con ambas activas, revocar la antigua. 7. Auditar todos los accesos por API Key.
Notes
- Nunca loguear la API Key completa; solo los últimos 4 caracteres para identificación.
- Implementar scopes por key:
verify,status,admin. - Las keys expiradas se revocan automáticamente; el cliente debe renovar proactivamente.
List_Agents.md
list_skills.md
CLAUDE.md
Agents.md
.DS_StoreRelated skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85