The API must provide protected storage for API keys.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-274830 | SRG-APP-000915-API-001610 | SV-274830r1143869_rule | CCI-004910 | medium |
| Description | ||||
| API key exposure introduces security vulnerabilities to hosted applications. Store API keys securely, avoiding plaintext storage. Avoid plain text storage within application code or application source trees. | ||||
| STIG | Date | |||
| Application Programming Interface (API) Security Requirements Guide | 2025-09-24 | |||
Details
Check Text (C-274830r1143869_chk)
Verify the API is configured to provide protected storage for API keys, ensuring they are encrypted at rest using cryptographic mechanisms that comply with NIST-approved algorithms and key management standards (e.g., AES-256, FIPS 140-3 validated modules). Protected storage must prevent unauthorized access, tampering, or disclosure of keys, and must enforce access controls consistent with the principle of least privilege. This includes storing keys in secure vaults, hardware security modules (HSMs), or encrypted databases.
If the API is not configured to provide protected storage for API keys, this is a finding.
Fix Text (F-78836r1143500_fix)
Build or configure the API to provide protected storage using cryptographic mechanisms that comply with NIST-approved algorithms and key management standards (e.g., AES-256, FIPS 140-3 validated modules) for API keys.