🔐
AB-145
No static API keys in OpenAPI security
What it means
Your OpenAPI spec does not use apiKey security schemes.
Why it matters
Static API keys are permanent shared secrets — the opposite of session-scoped auth. Removing them from OpenAPI security forces OAuth2 adoption.
✗
What's wrong
OpenAPI: { components: { securitySchemes: { ApiKey: { type: 'apiKey', in: 'header' } } } }
✓
What's right
OpenAPI: { components: { securitySchemes: { OAuth2: { type: 'oauth2', flows: {...} } } } }
Check this rule on your site
Enter your URL to check just this one rule (AB-001).