🔐
AB-128
OAuth2 preferred over static API keys
What it means
Your API uses OAuth2 security schemes instead of static API keys.
Why it matters
OAuth2 enables session-scoped, revocable tokens — agents can authenticate without permanent shared secrets. Static API keys never expire and are equivalent to sharing a password.
✗
What's wrong
OpenAPI security scheme: { type: 'apiKey', in: 'header', name: 'X-API-Key' }
✓
What's right
OpenAPI security scheme: { type: 'oauth2', flows: { clientCredentials: { tokenUrl: '/oauth/token', scopes: { read: 'Read access' } } } }
Check this rule on your site
Enter your URL to check just this one rule (AB-001).