← Back to Application Programming Interface (API) Security Requirements Guide

V-274830

CAT II (Medium)

The API must provide protected storage for API keys.

Rule ID

SV-274830r1143869_rule

STIG

Application Programming Interface (API) Security Requirements Guide

Version

V1R1

CCIs

CCI-004910

Discussion

API key exposure introduces security vulnerabilities to hosted applications. Store API keys securely, avoiding plaintext storage. Avoid plain text storage within application code or application source trees.

Check Content

Verify the API is configured to provide protected storage for API keys, ensuring they are encrypted at rest using cryptographic mechanisms that comply with NIST-approved algorithms and key management standards (e.g., AES-256, FIPS 140-3 validated modules). Protected storage must prevent unauthorized access, tampering, or disclosure of keys, and must enforce access controls consistent with the principle of least privilege. This includes storing keys in secure vaults, hardware security modules (HSMs), or encrypted databases.

If the API is not configured to provide protected storage for API keys, this is a finding.

Fix Text

Build or configure the API to provide protected storage using cryptographic mechanisms that comply with NIST-approved algorithms and key management standards (e.g., AES-256, FIPS 140-3 validated modules) for API keys.