API keys scoped to minimum permissions

An API key with full administrative access is a skeleton key: if it leaks — through a log line, a git commit, a compromised developer laptop — the attacker inherits every permission you have. OWASP A01 (Broken Access Control) and NIST AC-6 (Least Privilege) both require limiting credentials to only the operations they need. A Stripe key scoped to charge creation cannot be used to delete customer data or issue refunds. A SendGrid key scoped to sending cannot expose your contact list. PCI-DSS 4.0 Req-7.2 requires that access to system components is appropriately defined and granted — overly broad API keys violate this at the integration layer.

Audit each external service's dashboard and create restricted keys with only the permissions your application actually exercises. Document each key's scope in your secrets manager description field.

// src/config/api-keys.ts — one scoped key per service per environment
export const stripeKey = process.env.STRIPE_RESTRICTED_KEY   // charges + webhooks only
export const openaiKey = process.env.OPENAI_API_KEY           // completions only, no admin
export const sendgridKey = process.env.SENDGRID_MAIL_ONLY_KEY // mail send only

Stripe: Dashboard → Developers → API keys → Create restricted key → select "Charges: Write" and "Webhooks: Read" only. SendGrid: Settings → API Keys → Restricted Access → Mail Send. Generate new restricted keys, update your secrets manager, then revoke the old full-access keys.