A Solution to Rampant Token Theft: Proof of Possession

This site does not allow itself to be embedded. You can still read it on the original site — the toolbar below keeps your place in the directory.

Static API keys in environment variables and files are too easy to steal. A better model is proof-of-possession, where every API call must be signed by a non-exportable private key that is available only through a constrained signing interface.

Read on ben3d.ca ↗