Lion Cipher Lab
Manage service accounts and API keys safely (mint, scope, use, rotate, revoke)
- Identity & Access Management
- Beginner
- ~40-50 min
- Free · no account required
Why it matters
Not every login is a human typing a password. Software constantly needs to prove who it is to OTHER software -- a script pulling data from a service, a deploy pipeline pushing code, a backup job talking to storage. The credentials that let one machine or program authenticate to another are called NON-HUMAN credentials, and they come in a few flavors you will hear constantly: an API key (a secret string a program sends to identify itself to a service's Application Programming Interface -- the doorway other programs call), a token (a similar secret string, usually scoped and time-limited, that…
What you'll learn
- what an API key, a token, and a service account are, in plain terms, and how they differ from a human password login
- what a 'scope' (permission) is and why least privilege means giving a credential the smallest access that still does the job
- minting a real, scoped credential end to end: a GitHub fine-grained personal access token on your OWN account, with an expiry
- using the token to make a real authenticated API call and confirming it worked
- storing a non-human credential correctly in an environment variable, never pasted into code or shared
- rotating a credential: issuing a fresh one and retiring the old so an exposed value stops working
- revoking (deleting) a credential the instant it is no longer needed, and confirming it no longer works
- the habit of setting an expiry and revoking-when-done so credentials do not pile up and outlive their purpose
Steps in this lab
- Learn the words: API key, token, service account, scope, least privilege
- First, the safety rules for this lab
- Pick (or create) the ONE repository this token will be allowed to touch
- Mint a scoped, expiring token: the exact click path
- Open your terminal and store the token in an environment variable
- USE the token: make a real authenticated API call
- Understand storage: why the token must never live in your code
- ROTATE the token: issue a fresh one, retire the old
- REVOKE both tokens and PROVE they are dead
- Make it a habit, and where to go next