@svpino: Back in 2010, we could get away with SSH keys and API tokens in .env files. We can't do that anymore. I went down a rab…
Summary
The post argues that static credentials like SSH keys and API tokens are no longer sufficient, and identity-based access is a better alternative.
View Cached Full Text
Cached at: 05/14/26, 04:41 PM
Back in 2010, we could get away with SSH keys and API tokens in .env files.
We can’t do that anymore.
I went down a rabbit hole to understand how identity-based access is much better (and it’s replacing) static credentials. https://t.co/aFCpgEeW9s
Similar Articles
@XQOPTRX: [AGENT IDENTITY] — DESCOPE LAUNCHES CROSS-APP ACCESS TO REPLACE STATIC API KEYS WITH SHORT-LIVED IDENTITY ASSERTIONS FO…
Descope launches Cross-App Access to replace static API keys with short-lived identity assertions for AI agents and MCP servers, enabling enterprises to govern agent access through existing identity providers with per-request authorization policies.
Where .env Went Wrong
A technical analysis of why .env files became a de facto configuration standard despite lacking schema, spec, and security semantics, and why teams should replace them with more durable declarations.
Securing agentic identity
A security expert discusses the challenge of securing identity tokens for LLM agents that access sensitive resources, and proposes a proxy-based approach to bind tokens to specific environments to prevent credential theft.
What's the best way to do authentication in modern applications
The article discusses the security implications of storing authentication tokens in localStorage versus cookies, emphasizing the risks of XSS attacks and the benefits of using httpOnly cookies for sensitive apps.
CLI Authentication, the Right Way
This article critiques the common OAuth loopback authentication pattern used by many CLI tools, which fails on headless machines, and advocates for alternative methods like device code flow that have been standard since 2019.