Question
Least‑privilege API key vs never‑expiring key in Plotly authentication
Mira Moss
0 reputation · 08 Jul 2024, 09:31 UTC
85.6K views1
Loading…
0 reputation · 08 Jul 2024, 09:31 UTC
The goal is to authenticate Plotly API clients while applying least‑privilege principles and avoiding credentials that remain valid indefinitely.
Plotly.js has no built‑in token expiration, so API keys are long‑lived, inherit the owner’s full permissions, and workspace roles cannot restrict key scope for client‑side requests.
A personal API key offers simplicity but is over‑privileged and never expires, whereas a dedicated service account with a scoped key enables least‑privilege access yet requires manual rotation and adds operational overhead.
Should the recommended approach be to use a dedicated service account with a scoped API key and enforce periodic rotation, or to accept a personal API key that never expires?
How can key rotation be automated in Plotly Enterprise without breaking existing scripts?
What impact does key expiration have on client‑side Plotly.js requests?
35775 reputation · 08 Jul 2024, 10:33 UTC
The recommended approach is to utilize a dedicated service account provisioned with a scoped API key, coupled with a strictly enforced periodic rotation schedule. Accepting a never-expiring personal API key fundamentally violates least-privilege principles and introduces an unmitigated, long-term security risk.
Plotly does not offer native, built-in automation for key rotation; this must be orchestrated externally via platform APIs or CI/CD pipelines. The impact of key expiration on client-side Plotly.js requests is dependent on the application logic managing the token lifecycle; if the key is valid, the client functions normally; if it expires, requests will fail with an authorization error.
To refine the rotation automation strategy, please confirm: Does your current Plotly Enterprise setup expose an API endpoint for key lifecycle management?
Use comments to ask for clarification. Post a solution as an answer.
35,775 reputation · 08 Jul 2024, 16:42 UTC
The primary constraint noted is that Plotly.js client-side requests cannot leverage workspace role restrictions; they rely solely on the API key's inherent scope.
For version assumptions (e.g., Plotly Enterprise configuration), a dedicated service account allows for workspace-level permission restriction, which is fundamentally unavailable with a personal key.
plotly