A new approach to API key security
Applications
need access.
API keys need
protection.
Give applications and AI agents access to the services they need. Keep the original provider keys inside a controlled protection layer.
A category initiative by VaultProof
stays here.
The original key stays outside the caller.
A name for protecting
keys where they are used.
What is Active
Key Protection?
Active Key Protection is a cybersecurity approach that keeps raw provider API keys outside the applications and AI agents that use them, controls access through a protected request path, and makes that access observable and revocable.
It brings credential separation, access controls, safe activity records, and revocation together around the provider request.
Read the full explanation02 / The exposure problem
Every copy of a key
is another place to protect.
A provider key can travel further than the team intended. Follow the copies through a typical development workflow.
Local configuration
A key added to an environment file.
Deployment settings
The same key copied into hosting and CI.
Debug output
A configuration value printed while troubleshooting.
AI context
A file or snippet shared with an agent.
Active Key Protection reduces the raw provider-key copies needed by supported application runtimes.
See how the approaches fit together03 / The principles
Five principles.
One protected request path.
A category needs clear criteria. These are the five principles VaultProof proposes for evaluating Active Key Protection.
Separate
Applications and agents receive mediated access without retrieving the raw provider credential.
Mediate
Authenticate the caller and apply access checks before a request reaches the provider.
Constrain
Enforce documented restrictions on the services and operations a caller can use.
Observe
Record useful request metadata so operators can understand usage and investigate issues.
Revoke
Disable access through the protection layer when it is no longer needed or trusted.
Proposed evaluation criteria. Open for scrutiny.
Read the evaluation frameworkBuilding the category.
Putting it into practice.
VaultProof is pioneering Active Key Protection: advancing the category and building a product around keeping provider keys outside applications, controlling their use, and giving operators visibility.
See the VaultProof approachThis site is published by VaultProof. Our proposed definition builds on established security practices.
Keep exploring