🔐
AB-145

No static API keys in OpenAPI security

🔐 Bot Authentication Moderate effort Est. cost: $0

What it means

Your OpenAPI spec does not use apiKey security schemes.

Why it matters

Static API keys are permanent shared secrets — the opposite of session-scoped auth. Removing them from OpenAPI security forces OAuth2 adoption.

What's wrong

OpenAPI: { components: { securitySchemes: { ApiKey: { type: 'apiKey', in: 'header' } } } }

What's right

OpenAPI: { components: { securitySchemes: { OAuth2: { type: 'oauth2', flows: {...} } } } }

Check this rule on your site

Enter your URL to check just this one rule (AB-001).

Related rules in Bot Authentication