How many of your API keys could burn your whole account?
Most teams hand every agent the same god-mode API key: full permissions, no spend cap, no expiry. One compromised or misbehaving agent and the blast radius is your entire account. Run this 30-second key-scope audit on your AI provider keys right now. No signup, nothing installed.
The 30-second key-scope audit
1
Count your keys. Open your provider dashboard (OpenAI: platform.openai.com → API keys; Anthropic: console.anthropic.com → API keys) and count them.
Keys you don't recognize, or one shared key across everything → FAIL. Every agent, every environment, every human should have its own key.
One key per agent/service, all named → good. Continue to step 2.
2
Check each key's permissions. For every key ask: does this agent need all of this? A summarizer doesn't need fine-tuning rights; a support bot doesn't need admin scopes.
Any key with "all permissions" or scopes the agent never uses → FAIL. Least privilege isn't bureaucracy — it's blast-radius control.
3
Check spend caps and alerts. Open usage/billing limits. Is there a hard monthly cap per key? An alert before it hits?
No cap + no alert + agent with a loop bug = a five-figure invoice.
Set: hard cap per key, alert at 50% and 80%.
No caps anywhere → FAIL. This is the check that saves real money.
Per-key caps + alerts set → you're covered. Add a kill-switch drill: can you revoke one key in under a minute?
Bonus: check key age. Any key older than a year that nobody rotates is a key nobody owns.
If you failed any check, do this now
Split the god-key — one scoped key per agent, least privilege each.
Set hard spend caps per key and billing alerts at 50% and 80%.
Rotate the unknowns — if you can't say what a key is for, revoke and reissue.
Practice the kill switch — revoking one rogue agent's key should take seconds, not a support ticket.
This page audited your keys by hand. Agent Auth Gateway automates it — per-agent scoped credentials, budget caps, domain allowlists, approval queues, and a kill switch for the moment one goes rogue.