Design a simple secure API key management system
FreeSecurity systemEasy
- Beginner
- System design
- Security
Quick answer
This security system interview question asks you to design a simple secure API key management system. Aim for a design that protects users and data without blocking legitimate use, then explain the threats, controls, detection and trade-offs. Interviewers want to see how you model threats and layer defences.
The problem
Design a simple secure API key management system for generating, storing, validating, rotating, and revoking API keys.
What must a simple secure API key management system do?
- Users or services can generate API keys.
- API keys should have metadata such as owner, scope, creation time, expiry, and status.
- The system should validate API keys on incoming requests.
- The system should support key scopes and permissions.
- The system should support key rotation with an overlap window.
- The system should support immediate revocation of compromised keys.
- The system should log key lifecycle events and validation failures.
- Admins can view usage, revoke keys, and manage policies.
How well must it do it?
- Key validation should be low latency.
- API keys should be generated using secure randomness.
- Keys should not be stored in plaintext when avoidable.
- The system should remain available during high API traffic.
- Revoked keys should stop working quickly.
- Audit logs should be durable and tamper-resistant.
- Key management operations should require strong authentication and authorization.
What scale should you design for?
Use these numbers in your estimates.
| Assumption | Estimate active API keys from developer count and services per developer |
|---|---|
| Assumption | Estimate validation QPS from total API request traffic |
| Assumption | Peak validation traffic may be 3x to 10x average traffic |
| Assumption | Estimate storage using key metadata, hashed keys, audit logs, and usage records |
| Assumption | Cache hit ratio strongly affects validation latency and database load |
| Assumption | Audit log storage may grow faster than key metadata storage |
Key concepts
- Beginner
- System design
- Security
- API management
- API keys
- Key rotation
How you’ll practise
6 short steps · save and come back any time
- Requirements and assets
- Threat model
- Identity and access
- Data protection
- Detection and response
- Wrap-up
Lala, personalized to you, gives a hint when you ask and reviews your design when you are ready.
What do interviewers look for?
In any security system design round.
- Starts with a clear threat model
- Layers defences instead of relying on one control
- Covers authentication, authorisation and secrets
- Plans detection, alerting and response
- Protects data in transit and at rest
- Balances security against usability and cost
Questions people ask about this interview question
- Which design type is this question?
- It is a security system question. You design a simple secure API key management system and explain your choices the way you would in an interview.
- Is this question asked at entry level?
- It is marked Easy, so it suits engineers who are new to security system interviews. It is also a good warm-up before harder questions.
- What should I cover first?
- Start with what must be protected, from whom and what a breach would cost. Agree on scope with the interviewer before you design anything.
- Can I practise it for free?
- Yes. It is one of the free questions. Sign up to practise it step by step. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.
Related questions
Updated · Written by the SevyDevy team