# Key Shape

> Check a platform's API key design before a key leaks, then plan the day one does. Describe the keys and paste a
> few test keys; the browser checks the prefix and its environment marker, the body's entropy against the 120-bit
> floor, verifies each test key's checksum (CRC32 of the body as 6 base62 characters), checks that secret scanners
> could find the keys, ranks storage and scoping from a short interview, and runs the rotation, dashboard, ownership,
> governance and OWASP API2 checks. The pasted keys never leave the page - never sent with a run, never saved. Metered
> runs write the key design, and the rotation and leak-response runbook. Built on the SkillSafe skill
> @samber/api-auth-key-management, from samber/developer-platform-skills (MIT), by Samuel Berthe.

https://key-shape.skillsafe.ai/

## What is free
- Format: a type prefix ending in _, an environment in the prefix, a prefix distinctive enough for scanners, at least 120 bits of randomness (length times log2 of the alphabet), a checksum.
- Test keys: each pasted key matched against the format and its checksum verified - in the browser only, shown masked.
- Storage and scoping: plaintext or app-managed encryption flagged; scopes that fail open; the storage rung (hash-only, KMS-encrypted retrievable, workload identity) and the scoping rung (per-environment coarse, fine-grained) from the interview.
- Rotation and dashboard: one atomic roll, 1-7 days of routine grace, at most two active keys, sign up / create / rotate / revoke without a ticket, masking and last-used.
- Ownership and governance: service-account keys, offboarding, an audit log where compliance asks, expiry.
- OWASP API2: keys in browsers or apps, no rate limit on validation, non-constant-time comparison, a hardcoded fallback secret.
- A secret-scanner pattern for the format, fresh test keys from the browser's cryptographic random source, and exports: the checks (.csv), everything (.json).

## The metered lanes
Two tasks on gpt-terra, metered per run, routed by `task`. Input string fields: `task` (design or runbook), `platform`, `keys`, `carry` (runbook only: the design's decisions) and `facts`. No pasted key is ever part of the input.
- `design` replies with `summary`, `format` (prefixes, body, alphabet, checksum, an invented example, a scanner pattern), `storage`, `scoping`, `rotation`, `dashboard`, `ownership`, `governance`, `oauth` and `caveats`.
- `runbook` replies with `summary`, `rotation` (steps with owners and checks), `leak` (steps with owners and times), `offboarding`, `comms`, `metrics` and `caveats`.
The page holds every reply to its own facts: the ranked rungs, an environment prefix, 120+ bits, a checksum, an example key that follows the format, verifies and matches its pattern, the rotation numbers, the four self-service actions, a service-account tier; a rotation that creates before it revokes and waits for zero traffic, a leaked key revoked at once, and no key printed.

## Links
- API tutorial: https://key-shape.skillsafe.ai/api.html
- Source skill: https://skillsafe.ai/skill/@samber/api-auth-key-management