Audit logs for API key and token usage
Provide audit tooling and activity logs specifically for API key and token usage. This would allow security teams to monitor external access and track when and how API keys are being used.
2
votes
AdminAllison
(Technical Success Analyst, UserVoice)
shared this idea
-
Lindsey Giles
commented
Audit entries should identify the key by a masked label, record the timestamp, endpoint, source IP, and success or failure, and cover creation, rotation, revocation, and use. Never log the secret itself; exportable logs and retention controls would make this useful for incident reviews.