How to audit API gateway keys and usage plans: inventory, scope, usage and clean-up

API gateway keys are long-lived shared secrets that rarely expire, are often issued to a partner years ago and forgotten, and on some platforms open every API in a plan once one is issued. This guide is a step-by-step audit of the keys and usage plans on two common gateways: Amazon API Gateway REST APIs (API keys and usage plans) and Azure API Management (subscriptions and their keys). It shows how to list every key, map it to the APIs it opens, find which methods rely on a key alone, measure real use, assign owners, and then disable, rotate or replace keys with a rollback ready. It is for API platform teams, cloud security engineers and anyone asked to prove who holds access to a public API. The design principles behind gateway credentials are covered in the API Gateway Security Guide.

Key takeaways

• A key's reach is set by its plan or scope: AWS warns that a valid key for one API in a usage plan can access all APIs in that plan, and an Azure API Management subscription can be scoped to a product, a single API or all APIs. Audit the scope, not just the key.
• Find methods protected by a key alone: on Amazon API Gateway, a method with apiKeyRequired true and authorizationType NONE is protected only by a shared string, which AWS says should not be used for authentication or authorisation.
• Nothing expires by itself: Microsoft states API Management has no built-in expiry or automatic rotation for subscription keys, and AWS keys stay enabled until someone disables them. Age and last use are your controls.
• The built-in all-access subscription is a master key: every API Management instance has one that opens every API; Microsoft says never to embed it in client apps. Check who has used it.
• Quotas are not a security boundary: AWS describes usage plan throttles and quotas as best effort and says not to rely on them to control costs or block access. Use them for fairness, and use WAF, budgets and real authentication for protection.

When you need this

• Partner or customer offboarding: a contract ends but its key still works. The audit finds keys with no live owner.
• Key leak response: a key turns up in a public repository or a mobile app. You need to know in minutes what that key opens. See the Developer Secret Scanning Triage guide for the intake side.
• Periodic access review: keys are non-human credentials and belong in the same review cycle as service accounts. See How to Run an Access Review for Service Accounts.
• Before moving to token-based access: the inventory tells you which callers must migrate. See the API Keys vs OAuth Tokens Guide.

Before you start

• Read-only access: on AWS, an IAM role that can call the API Gateway GET operations in every Region and account in scope; on Azure, a role that can read API Management instances. Listing key values is more sensitive than listing metadata, so keep --include-values and listSecrets out of the routine audit.
• Scope: every AWS account and Region with REST APIs, and every API Management instance (including workspaces). Gateways created by product teams outside the platform account are the usual blind spot.
• Logging in place: API Gateway access logs with the API key ID, and API Management resource logs sent to Log Analytics (ApiManagementGatewayLogs). Without request logs you can only see quota counters, not who called what.
• A register: key or subscription ID, name, owner, scope, plan or product, created date, last used, enabled state, decision. The API Key Management Standard Template sets the rules you will measure against.

Step-by-step

1. Know the objects you are auditing

2. Inventory keys and plans on Amazon API Gateway (read-only)

1. List keys without values: aws apigateway get-api-keys returns id, name, enabled, createdDate, lastUpdatedDate, stageKeys, customerId and tags. Do not add --include-values for the audit; the value is only needed if you must match a leaked string, and then only for that one key.
2. List usage plans: aws apigateway get-usage-plans returns each plan's apiStages (API ID and stage), throttle and quota. To find the plans one key belongs to, add --key-id <id>.
3. List keys per plan: aws apigateway get-usage-plan-keys --usage-plan-id <id> gives the keys attached to each plan. AWS allows one key in several plans, but only one plan per stage for a given key.
4. Find what each stage exposes: for each API in a plan, aws apigateway get-resources --rest-api-id <id> --embed methods returns each method with apiKeyRequired, authorizationType (NONE, AWS_IAM, CUSTOM or COGNITO_USER_POOLS) and authorizerId.
5. Record the key source: read apiKeySource on each REST API. With AUTHORIZER, the Lambda authoriser supplies the key, so the audit must include where that function gets keys from.
6. Repeat in every Region and account. Paginate with the position value returned by each call.

3. Inventory subscriptions on Azure API Management (read-only)

1. List subscriptions: call the Subscription List REST operation, GET .../providers/Microsoft.ApiManagement/service/{serviceName}/subscriptions?api-version=2024-05-01. Each result gives scope (for example /products/{productId}, /apis or /apis/{apiId}), state, ownerId, displayName, createdDate, expirationDate and allowTracing.
2. Do not pull keys: Microsoft documents that primaryKey and secondaryKey are not filled on GET; they need a POST to listSecrets. Leave that out of the audit and alert on it instead (step 6).
3. Filter for the risky scopes: $filter supports scope, state, ownerId and productId. Pull /apis (all APIs) and the built-in all-access subscription first.
4. Check which APIs and products need no subscription: in each product's settings, check Requires subscription, and in each API's settings, Subscription required. Microsoft notes that when the requirement is off, a key in the request is ignored and the API is open unless another mechanism protects it.
5. Note scope effects: Microsoft states that product-scope policies are not applied to requests from API-scoped, all-APIs or all-access subscriptions. A rate limit set on a product does not limit those keys.

4. Map each key to what it can reach

Join the outputs: key to plan (or subscription to scope), plan to stages, stage to methods. For each key, record the APIs and methods it opens and how each method authenticates. Then classify:

5. Measure real use

• AWS quota counters: aws apigateway get-usage --usage-plan-id <id> --start-date <YYYY-MM-DD> --end-date <YYYY-MM-DD> returns, per key, a daily pair of used and remaining quota. A key with zero use over 90 days is a candidate for disabling. This only works for plans with a quota.
• AWS access logs: include $context.identity.apiKeyId, $context.identity.sourceIp, $context.status and $context.requestTime in the access log format. Log the key ID, not $context.identity.apiKey, which is the key itself and would turn your log store into a key store.
• APIM gateway logs: in Log Analytics, group ApiManagementGatewayLogs by ApimSubscriptionId, ApiId, CallerIpAddress and ResponseCode over 90 days to find last use, unexpected source networks and failed calls.
• Look for misuse patterns: one key from many unrelated IP ranges, a sudden jump in calls, a partner key used outside its expected APIs, or repeated 403 responses that suggest someone trying keys.

6. Watch the control plane

AWS CloudTrail records API Gateway management calls as events (except TestInvokeAuthorizer and TestInvokeMethod), so key creation, import, update, deletion and usage plan changes are all visible. Review GetApiKey and GetApiKeys calls by unexpected principals, since these can return key values, and alert on ImportApiKeys, and on changes that set apiKeyRequired to false. In Azure, the activity log records listSecrets and key regeneration on subscriptions; alert on both outside approved automation. The AWS CloudTrail Guide covers trail coverage across accounts.

7. Assign owners and decide

Small teams with a handful of partner keys can do this by email in a week. Platforms with thousands of developer-portal keys should automate: tag every key with an owner and a customer ID at issue, and let unused self-service keys expire through a scheduled job, because neither gateway does it for you.

8. Remediate with a rollback ready (destructive, change-controlled)

1. Disable before delete: on AWS, set the key's enabled flag to false; on Azure, set the subscription state to suspended. Both are reversible. Wait one billing or usage cycle before deleting.
2. Rotate Azure keys with the pair: Microsoft designs keys in pairs so a caller can switch from the primary to the secondary while you regenerate the primary, then the reverse. Confirm the caller has switched in the gateway logs before regenerating the second key.
3. Rotate AWS keys by replacement: create a new key, add it to the same usage plan, give it to the caller, watch the logs for the new key ID, then disable the old key. AWS notes that adding a key to a plan can take a few minutes to take effect.
4. Narrow scope: split broad usage plans or all-APIs subscriptions into per-product ones, issue new keys, migrate callers, then retire the old plan.
5. Add real authentication: attach an IAM, Lambda or Cognito authoriser in AWS, or a validate-jwt style policy in APIM, so the key returns to its proper role of identifying and metering a client.

Verify it worked

The targets below are NHI Mgmt Group recommendations, not vendor or regulatory requirements.

Rollback and common errors

• Rollback: re-enable the AWS key or reactivate the APIM subscription. Because you disabled rather than deleted, the caller's existing key works again without reissue. A deleted key has to be recreated and redistributed, so keep deletion for after the review cycle.
• Auditing keys but not plans: a well-owned key in an over-broad plan still opens APIs it was never meant for.
• Relying on quotas for abuse control: AWS states clients can exceed quotas in some cases. Use AWS WAF, budgets and authentication for that job, and the OWASP API Top 10 API4 Unrestricted Resource Consumption Guide for the wider controls.
• Logging the key instead of its ID: AWS says keys travel in headers that can be logged; logging $context.identity.apiKey or full request headers copies every key into the log platform.
• Keys in the query string: the APIM subscription-key query parameter puts keys in URLs, proxy logs and browser history. Disable it per API by requiring the header.
• Forgetting the developer portal: AWS notes that customers can subscribe to all APIs in a usage plan through a developer portal even if you have not made them visible.

Where identity fits

Each key is a non-human identity: a credential held by another organisation's software or by your own front end, with no person attached at the time of use. Treat keys with the same lifecycle as other machine credentials: an owner at issue, a scope, a review date and a retirement path. The API Key Management Guide covers issuance and storage, and the Azure API Management Security guide covers the management plane identities that can read every key.

Framework mapping

Practitioner checklist

• List every API key and usage plan in every AWS account and Region, without key values.
• List every APIM subscription with scope, state, owner and allowTracing, without calling listSecrets.
• Map each key to the stages, APIs and methods it opens, and flag methods where the key is the only control.
• Check products and APIs with the subscription requirement turned off.
• Measure last use from get-usage, access logs and ApiManagementGatewayLogs, logging key IDs only.
• Alert on key value reads, imports, regeneration and changes to apiKeyRequired.
• Assign owners, then disable or suspend unused keys before deleting them.
• Rotate exposed keys by replacement or the primary and secondary swap, and add real authentication behind keys.

Standards and references

• AWS: Usage plans and API keys for REST APIs in API Gateway
• AWS: Choose an API key source in API Gateway
• AWS CLI Command Reference: get-api-keys
• AWS: Variables for access logging in API Gateway
• AWS: Logging API Gateway API calls using AWS CloudTrail
• Microsoft Learn: Subscriptions in Azure API Management
• Microsoft Learn: API Management REST, Subscription List
• Microsoft Learn: ApiManagementGatewayLogs table reference

Related NHI Mgmt Group resources: API Security Guide, Apigee Security, Kong Gateway Security Guide, OWASP API Top 10 API2 Broken Authentication Guide.