Skip to content
AI Security

Interview question · Identity, OAuth & Access Control

How do services authenticate to each other without long-lived secrets?

Static API keys in environment variables are the most common credential leak there is. The answer is platform-issued, short-lived, attested identity.

mediumNewPreparation tags: Google, Amazon, MicrosoftUpdated Nov 2026

Static API keys in environment variables are the most common credential leak there is. The answer is platform-issued, short-lived, attested identity.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

Services authenticate to cloud APIs with long-lived access keys stored in environment variables, and one key recently appeared in a public repository.

  1. What is wrong with long-lived keys in environment variables?
  2. What should replace them?
  3. How do CI pipelines get cloud access without keys?
  4. How do services authenticate to each other?
  5. What do you do about the leaked key now?
  6. What migration plan would you propose?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackWhy must a server reject tokens that were not issued for it, and what goes wrong with token passthrough?Next in this trackWalk through redirect URI validation, state, mix-up attacks, and what current OAuth security best practice requires.Next in this trackHow do SAML single sign-on and Kerberos work at a high level, and where is trust anchored?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.