AI / OpenClaw Interview Questions
Why do security researchers recommend OAuth over long-lived API keys for OpenClaw skill integrations?
A long-lived API key is a static credential, if it leaks, it typically remains valid and usable until someone manually notices and revokes it.
- OAuth instead issues scoped, time-limited authorization tokens rather than a permanent static secret
- A leaked OAuth token naturally expires and is limited to whatever scope was originally granted, reducing how much damage it can do if compromised
- Most major SaaS platforms already support OAuth flows for programmatic access, so this isn't usually a matter of missing support, just a configuration choice
Given that a compromised skill inherits whatever credentials it was configured with, choosing OAuth over a static key is one of the more effective, low-effort ways to limit the blast radius if a skill turns out to be malicious or gets compromised later.
What is a downside of a long-lived static API key if it leaks?
What does an OAuth token provide that a static key doesn't?
More Related questions...
