API keys don't equal security. Here are 10 reasons why.
Bill Doerrfeld | May 22, 2026
My
latest on Nordic APIs looks at the core insecurities with API keys.
Minting and sharing API keys is a really easy way to share access to a system. However, it's not a very secure method if used alone.
API keys are long-lived, leaked constantly, easily reused by hackers, rarely cycled, and usually provide over-permissioned access.
We keep seeing API keys involved in major breaches. And I think a core reason is that API keys are often conflated with authentication and authorization — which they really aren't.
I walk through a lot of this on the Nordic APIs blog, looking at
10 major issues with API keys, and what API keys should be complemented with for actual API security.
Other Blog Posts
My latest for LeadDev interviews a Meta engineer who built an agentic system to optimize their capacity planning, leading to real power use savings.
I set out expecting to write an article about how every enterprise was jumping on trendy alternative or "neo" clouds. That ended up not being the case.
Join the virtual AI Pen-Testing Conference to explore how AI is changing penetration testing, red teaming, and the security testing of AI systems.
Counting down to Nordic APIs Summit 2026 in Stockholm, featuring 60+ speakers exploring agentic AI, APIs, MCP, and security.
I covered a Yale and GitHub report on LeadDev that explores developer attitudes on climate change and curbing IT waste.
Does your agent really need access to every tool call under the sun?
I'll be writing a weekly series for The New Stack this fall covering Kubernetes, cloud native, and everything happening on the road to KubeCon in November.
I'm teaming up with Dan Barahona and AI Security University to put together the MCP Security Conference, a free half-day virtual event dedicated to MCP security .
My latest DirectorPlus edition interviews Shopify's head of engineering, Farhan Thawar, on their unique internal engineering culture.
Neoclouds promise cheaper GPUs and AI-optimized infrastructure, but can they really challenge hyperscalers? My feature on InfoWorld explores their advantages, risks, and likely role in AI compute.
