🎫 Honey API Key

Decoy API keys in config files and environment variables.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

A decoy API key for a service you control, placed in config files and environment variables next to real ones. An attacker who finds it will try it, because API keys usually work without any further login. The key unlocks nothing real; the request carrying it is logged by the API gateway, and that request is the signal.

Implementation requirements

AWS API Gateway: create an API key in a usage plan attached to a decoy stage or route, and plant the key in config files and environment variables
Monitoring: include $context.identity.apiKeyId in the access-log format, and alert on any request carrying the decoy key's ID
Return realistic responses (a plausible 403, or fake data). An obviously dead endpoint tells the attacker the key is bait
For third-party SaaS keys, prefer a key for a decoy service you run. Many vendors give you no per-key alert
Safety: the key unlocks nothing real. OPSEC: key name and usage-plan limits like real ones
Rollback: Delete the API key and the decoy usage plan or stage. Remove planted copies from configs and environment variables.
Upkeep: Rotate with real keys. Monthly proof-of-life request carrying the key.

Technologies

AWS

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1528 Steal Application Access Token	Credential Access	theoretical	moderate	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1528 Steal Application Access Token as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1528 to its Lures activity. A stolen honey token fires when it is used, not when it is stolen.
T1550.001 Application Access Token	Lateral Movement	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Kubeconfig token: any attempt to use the fake kubeconfig against its API server alerts. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1550.001 Application Access Token as an adversary behaviour.

Evidence

Decoy User Credential (D3-DUC) — MITRE D3FEND standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
AWS API Keys token — Canarytokens documentation — Thinkst Applied Research industry
GitGuardian Honeytoken — core concepts — GitGuardian industry