A SecurityWeek piece by Matt Honea discusses a proposed open standard to make leaked API keys self-destruct within minutes rather than hours or days. The concept, dubbed ORKS (Open Revocable Key Standard), aims to give every API key a built‑in mechanism for revocation and a discoverable way to contact the issuer. The proposal argues that current practise leaves most credentials active for long periods, with scanners and automated agents often unable to revoke keys consistently across providers.
The ORKS model comprises four parts. First, keys would name their issuer via a fixed prefix that includes an encoded issuer domain, the secret and a checksum, enabling offline identification of who to contact. Second, each issuer would publish a discoverable kill switch at a standard location (/.well-known/api-key-config) detailing its revocation endpoint and related capabilities.
Third, revocation would be by possession: anyone holding the full key could POST it to the revocation endpoint without authentication, returning an accepted response regardless of live status. Fourth, issuers would declare constraints such as IP allowlists, expiry, scopes and mTLS, allowing procurement tooling to query support for specific protections.
The piece also discusses a quarantine mode to limit disruption during a leak, and notes the growing relevance of revocation as autonomous AI agents hold and misuse credentials. The article references OAuth RFC 7009 as a historical precedent and points to GitHub’s Secret Scanning Partner Programme as a partial, proprietary example. The author invites community feedback on the ORKS draft on GitHub (ORKS v0.1).