Granular Scopes & Secret Hygiene
Best practices for API key generation, zero-trust scope assignment, and credential rotation.
Granular Scopes & Secret Hygiene
Shortyy is engineered for zero-trust environments where microservices, CI/CD workers, and background queues should only hold the exact privileges required for their task.
Principle of Least Privilege
When provisioning keys in the API Keys Manager, restrict scopes strictly to the service's role:
▪
Ingestion Workers (e.g. newsletter dispatch, SMS bot):
▪
Select only
links:write. If this key is accidentally leaked, an attacker cannot read existing links, delete infrastructure, or inspect financial analytics.▪
Reporting Dashboards:
▪
Select
links:read and analytics:read.▪
Administrative Sync:
▪
Full scope assignment.
Secret Scanner Integration
Shortyy keys begin with sh_live_ followed by 48 hex characters. This matches standard GitHub and GitLab secret detection regular expressions:
regex
sh_live_[0-9a-f]{48}If an employee accidentally commits a Shortyy key to a public GitHub repository, push protection immediately detects and blocks the commit before it reaches remote branches.