<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Key Management — API Reference

## AWS IAM Key Management

```bash
# Generate credential report
aws iam generate-credential-report
aws iam get-credential-report --output text --query Content | base64 -d

# List access keys for user
aws iam list-access-keys --user-name USERNAME

# Get key last used
aws iam get-access-key-last-used --access-key-id AKIAEXAMPLE

# Deactivate access key
aws iam update-access-key --user-name USERNAME --access-key-id AKIAEXAMPLE --status Inactive

# Delete access key
aws iam delete-access-key --user-name USERNAME --access-key-id AKIAEXAMPLE

# Get access advisor (last accessed services)
aws iam generate-service-last-accessed-details --arn ARN
aws iam get-service-last-accessed-details --job-id JOB_ID
```

## GCP Service Account Keys

```bash
# List service accounts
gcloud iam service-accounts list --format=json

# List keys for service account
gcloud iam service-accounts keys list --iam-account=SA_EMAIL --format=json

# Create key (for rotation)
gcloud iam service-accounts keys create key.json --iam-account=SA_EMAIL

# Delete old key
gcloud iam service-accounts keys delete KEY_ID --iam-account=SA_EMAIL
```

## GitHub Secret Scanning API

```bash
# Organization alerts
gh api /orgs/ORG/secret-scanning/alerts --jq '.[] | {number, state, secret_type}'

# Repository alerts
gh api /repos/OWNER/REPO/secret-scanning/alerts --jq '.'

# Resolve alert
gh api -X PATCH /repos/OWNER/REPO/secret-scanning/alerts/ALERT_NUMBER \
  -f state=resolved -f resolution=revoked
```

## Secret Scanning Tools

```bash
# truffleHog — scan git repo
trufflehog git https://github.com/org/repo --json --only-verified

# gitleaks — scan local directory
gitleaks detect --source . --report-path report.json --report-format json

# Pre-commit hook
# .pre-commit-config.yaml
# - repo: https://github.com/gitleaks/gitleaks
#   rev: v8.18.0
#   hooks:
#     - id: gitleaks
```

## Key Checks

| Check | Method | Expected |
|-------|--------|----------|
| Key age < 90 days | Credential report | All keys compliant |
| No unused keys | Last-used date | No key idle > 90 days |
| Secret scanning enabled | GitHub settings | Push protection on |
| No hardcoded secrets | gitleaks/truffleHog | Zero verified findings |
| OIDC federation for CI | Pipeline config | No static keys in CI |
