The Current State of API Key Traceability

Oct 13, 2025 by pinkandtrash.com 127 views

Problem Statement

As a user of Flagsmith, you may have encountered issues with audit log entries that lack visibility on which API key was used to perform an action. This can make it challenging to build complex integrations that users interact with, as you can only integrate with one API key that has permissions to do everything. In this article, we will explore two potential solutions to address this issue: improving API key traceability in audit logs and delegating access to the Admin API using OAuth.

The Current State of API Key Traceability

When an action is performed using an organisation API key, the audit log entry may not provide any information on which key was used. This can be seen in the following example:

In this example, the action in the bottom entry was performed using a user's personal Admin API token, while the action in the top was performed using an organisation API key, but we have no visibility on which key was used. This lack of traceability makes it difficult to build complex integrations that users interact with.

The Need for Improved API Key Traceability

To address this issue, we propose improving API key traceability in audit logs. This can be achieved by including context on how actions performed by API keys happened, such as mentioning the specific key name/prefix/etc or at a minimum, mentioning that it was done by an organisation API key instead of leaving the User field blank. This would provide users with the necessary information to build complex integrations that meet their specific needs.

Alternative Solution: Implementing OAuth for the Admin API

Another potential solution to address the issue of API key traceability is to implement OAuth for the Admin API. This would allow applications to integrate with Flagsmith so that they can interact with the Admin API directly using a user's token, which bypasses the problem of doing too much with a single organisation API key.

Benefits of Implementing OAuth

Implementing OAuth for the Admin API would provide several benefits, including:

Improved security: OAuth tokens would be short-lived and could have the same permission the user already does, or a subset.
Increased flexibility: OAuth would allow third parties to build their own custom integrations, which can be reused by any customer without having to hardcode API keys or implement another layer of authorisation/traceability on top of Flagsmith.
Enhanced user experience: OAuth would provide users with a more seamless and integrated experience when interacting with Flagsmith.

Example of OAuth Implementation

For example, LaunchDarkly has implemented OAuth for their Admin API, allowing third parties to build custom integrations that can be reused by any customer. This can be seen in the following example:

https://launchdarkly.com/docs/integrations/partner-integrations/oauth-client-registration

Conclusion

In conclusion, improving API key traceability in audit logs and delegating access to the Admin API using OAuth are two potential solutions to address the issue of API key traceability. By implementing OAuth, Flagsmith can provide users with a more secure, flexible, and integrated experience when interacting with the platform. We believe that implementing OAuth for the Admin API is a crucial step towards improving the overall user experience and providing users with the necessary tools to build complex integrations that meet their specific needs.

Recommendations

Based on our analysis, we recommend the following:

Improve API key traceability in audit logs: Include context on how actions performed by API keys happened, such as mentioning the specific key name/prefix/etc or at a minimum, mentioning that it was done by an organisation API key instead of leaving the User field blank.
Implement OAuth for the Admin API: Allow applications to integrate with Flagsmith so that they can interact with the Admin API directly using a user's token, which bypasses the problem of doing too much with a single organisation API key.

Q: What is the current state of API key traceability in Flagsmith?

A: Currently, when an action is performed using an organisation API key, the audit log entry may not provide any information on which key was used. This can be seen in the following example:

Q: Why is API key traceability important?

A: API key traceability is important because it allows users to build complex integrations that meet their specific needs. Without API key traceability, users can only integrate with one API key that has permissions to do everything, which can lead to security issues and a poor user experience.

Q: What is the proposed solution to improve API key traceability?

A: The proposed solution is to include context on how actions performed by API keys happened, such as mentioning the specific key name/prefix/etc or at a minimum, mentioning that it was done by an organisation API key instead of leaving the User field blank.

Q: What are the benefits of implementing OAuth for the Admin API?

A: Implementing OAuth for the Admin API would provide several benefits, including:

Improved security: OAuth tokens would be short-lived and could have the same permission the user already does, or a subset.
Increased flexibility: OAuth would allow third parties to build their own custom integrations, which can be reused by any customer without having to hardcode API keys or implement another layer of authorisation/traceability on top of Flagsmith.
Enhanced user experience: OAuth would provide users with a more seamless and integrated experience when interacting with Flagsmith.

Q: How does OAuth work?

A: OAuth is an authorization framework that allows users to grant third-party applications limited access to their resources on another service provider's website, without sharing their login credentials. In the context of Flagsmith, OAuth would allow applications to integrate with Flagsmith so that they can interact with the Admin API directly using a user's token.

Q: What is the difference between OAuth and API keys?

A: OAuth is an authorization framework that allows users to grant third-party applications limited access to their resources, while API keys are used to authenticate and authorize access to a service. OAuth provides a more secure and flexible way to authenticate and authorize access to a service, while API keys are often used for simple authentication and authorization.

Q: Can you provide an example of OAuth implementation?

A: Yes, LaunchDarkly has implemented OAuth for their Admin API, allowing third parties to build custom integrations that can be reused by any customer. This can be seen in the following example:

https://launchdarkly.com/docs/integrations/partner-integrations/oauth-client-registration

Q: What are the next steps for implementing OAuth for the Admin API?

A: The next steps for implementing OAuth for the Admin API would involve:

Designing the OAuth flow: Designing the OAuth flow to ensure that it meets the needs of users and third-party applications.
Implementing the OAuth server: Implementing the OAuth server to handle authentication and authorization requests.
Testing and deploying the OAuth implementation: Testing and deploying the OAuth implementation to ensure that it works as expected.

Q: What are the benefits of improving API key traceability?

A: Improving API key traceability would provide several benefits, including:

Improved security: Improved API key traceability would make it easier to detect and prevent security issues related to API keys.
Increased flexibility: Improved API key traceability would allow users to build complex integrations that meet their specific needs.
Enhanced user experience: Improved API key traceability would provide users with a more seamless and integrated experience when interacting with Flagsmith.

Q: What are the next steps for improving API key traceability?

A: The next steps for improving API key traceability would involve:

Designing the API key traceability system: Designing the API key traceability system to ensure that it meets the needs of users and third-party applications.
Implementing the API key traceability system: Implementing the API key traceability system to handle API key requests and provide traceability information.
Testing and deploying the API key traceability implementation: Testing and deploying the API key traceability implementation to ensure that it works as expected.