# Are API Keys Passwords? Yes, Here's Why

DevFeed: [Are API Keys Passwords? Yes, Here's Why](<https://devfeed.tech/articles/are-api-keys-passwords-yes-here-s-why-29570.md>)

Original publisher: [Read original article](<https://goteleport.com/blog/api-keys-are-passwords/>)

Author: info@goteleport.com (Gabrielle Coleman)

Published: 2021-12-29T00:00:00Z

Content type: opinion

Language: en

Sources: [Teleport](<https://devfeed.tech/sources/teleport.md>)

Topics: [API keys](<https://devfeed.tech/topics/api-keys.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [Security](<https://devfeed.tech/topics/security.md>), [certificates](<https://devfeed.tech/topics/certificates.md>), [code productivity](<https://devfeed.tech/topics/code-productivity.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [api-keys](<https://devfeed.tech/tags/api-keys.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [certificates](<https://devfeed.tech/tags/certificates.md>), [developer-productivity](<https://devfeed.tech/tags/developer-productivity.md>), [passwords](<https://devfeed.tech/tags/passwords.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

The article argues that API keys and other static access tokens function like passwords because they can be copied and used to access infrastructure. It presents identity-based, short-lived certificates as a more secure alternative that can also support fine-grained access controls and improve developer productivity.

## Source excerpt

There is a growing sense that protecting sensitive accounts with passwords is not enough. But API keys are passwords too and need to be replaced.