OFAC Screening API Key Management
The secure storage, rotation, and access control of API keys used to authenticate with sanctions screening services.
TL;DR
TL;DR: API key management covers how screening credentials are stored, rotated, and restricted. A leaked key allows unauthorized screening calls and can be abused to test counterparties or exhaust a quota.
Why keys matter
A screening API authenticates the caller with a key, so whoever holds the key can make calls on your behalf. A key committed to a public repository or left in a log file can be used by anyone to run checks, burn through a paid quota, or probe which counterparties your system is screening.
Core practices
- Store keys in a secret manager or environment variable, never in source code.
- Rotate keys on a schedule and immediately after any suspected exposure.
- Scope keys to the minimum needed and revoke unused ones.
- Monitor usage so a spike or an unexpected caller is noticed quickly.
For agent payment workflows
An agent that screens before it pays embeds a key in its runtime. The same rules apply: keep the key out of the codebase, out of logs, and out of prompts that might be shared. Where possible, prefer an integration that does not require a key at all. sanctionsai.dev offers a free tier of 5 checks per day with no signup and no key, which removes key management for low-volume or testing use, while paid plans cover higher volumes.