[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6H01PAE6012V00WRTWVCETE":3,"skill-same:01M6H01PAE6012V00WRTWVCETE":89},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":29,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":52,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":6,"ownerHtmlUrl":57,"ownerBlogUrl":58,"ownerDescription":59,"updatedAt":60,"install":61,"resources":74},"01M6H01PAE6012V00WRTWVCETE","rotate-and-scope-api-keys",null,"Use when provisioning credentials for an integration. Grant the narrowest scope, store the key in a secret manager, rotate on a schedule, and revoke the old key — broad non-expiring keys are the default failure.","jiayaoqijia\u002Fcryptoskill","jiayaoqijia","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1453879?v=4","01M6GMYTX7Q7S504VC6E756ENR","YQ","01M6GMYV1QKJ1CC75MTTGT9PR0",81,"MIT","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-rotate-and-scope-api-keys\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-rotate-and-scope-api-keys\u002FSKILL.md",[19,24],{"categoryNo":20,"categoryName":21,"taxonomyType":22,"taxonomyTypeDesc":23},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":25,"categoryName":26,"taxonomyType":27,"taxonomyTypeDesc":28},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"scope api","api keys","rotate and scope api keys","api","keys","scope","when","for","manager","secret manager","store","default","use","schedule","credentials","provisioning","integration","2026-11-10 10:12:30",false,"---\nname: rotate-and-scope-api-keys\ndescription: Use when provisioning credentials for an integration. Grant the narrowest scope, store the key in a secret manager, rotate on a schedule, and revoke the old key — broad non-expiring keys are the default failure.\n---\n\n# Rotate and scope API keys\n\nA single admin key with no expiry, pasted into an environment file, is the credential that ends\nup in a public repo. Provision narrowly, store centrally, rotate, and revoke.\n\n## Procedure\n\n1. Read the provider's scope model and grant only what each job needs (read-only where possible).\n2. Create a distinct key per service and environment; never share one across prod and dev.\n3. Store in a secret manager (`aws secretsmanager get-secret-value`, Vault, SOPS), not in committed `.env` or code.\n4. Set an expiry\u002Frotation cadence and automate rotation with an overlap window where both keys work.\n5. Revoke the old key after the new one is confirmed, then prove the old key now fails:\n   ```bash\n   curl -s -o \u002Fdev\u002Fnull -w '%{http_code}\\n' -H \"Authorization: Bearer $OLD\" \"$API\u002Fv1\u002Fme\"   # expect 401\n   ```\n6. Log which key id made which call so a leaked key can be traced.\n7. Alert before expiry so rotation is not a surprise outage.\n\n## Pitfalls\n\n- Keys pasted into source, CI logs, or chat leak on the first push; assume compromise and rotate.\n- An admin-scoped key on a read-only job violates least privilege.\n- Rotating with no overlap window breaks consumers at the switch instant.\n- Some providers display a key only once at creation; losing it forces a recreate, so store immediately.\n- Unused keys linger; audit and revoke anything with no calls in 90 days.\n\n## Verification\n\n    curl -s -o \u002Fdev\u002Fnull -w '%{http_code}\\n' -H \"Authorization: Bearer $OLD\" \"$API\u002Fv1\u002Fme\"   # 401\n    curl -s -o \u002Fdev\u002Fnull -w '%{http_code}\\n' -H \"Authorization: Bearer $NEW\" \"$API\u002Fv1\u002Fme\"   # 200\n    curl -s -H \"Authorization: Bearer $NEW\" \"$API\u002Fv1\u002Fscopes\" | jq .    # narrow scope list\n\nReport: \"Rotated key id k-92; old revoked (401), new active (200), scopes items:read.\"\n","# Rotate and scope API keys\n\nA single admin key with no expiry, pasted into an environment file, is the credential that ends\nup in a public repo. Provision narrowly, store centrally, rotate, and revoke.\n\n## Procedure\n\n1. Read the provider's scope model and grant only what each job needs (read-only where possible).\n2. Create a distinct key per service and environment; never share one across prod and dev.\n3. Store in a secret manager (`aws secretsmanager get-secret-value`, Vault, SOPS), not in committed `.env` or code.\n4. Set an expiry\u002Frotation cadence and automate rotation with an overlap window where both keys work.\n5. Revoke the old key after the new one is confirmed, then prove the old key now fails:\n   ```bash\n   curl -s -o \u002Fdev\u002Fnull -w '%{http_code}\\n' -H \"Authorization: Bearer $OLD\" \"$API\u002Fv1\u002Fme\"   # expect 401\n   ```\n6. Log which key id made which call so a leaked key can be traced.\n7. Alert before expiry so rotation is not a surprise outage.\n\n## Pitfalls\n\n- Keys pasted into source, CI logs, or chat leak on the first push; assume compromise and rotate.\n- An admin-scoped key on a read-only job violates least privilege.\n- Rotating with no overlap window breaks consumers at the switch instant.\n- Some providers display a key only once at creation; losing it forces a recreate, so store immediately.\n- Unused keys linger; audit and revoke anything with no calls in 90 days.\n\n## Verification\n\n    curl -s -o \u002Fdev\u002Fnull -w '%{http_code}\\n' -H \"Authorization: Bearer $OLD\" \"$API\u002Fv1\u002Fme\"   # 401\n    curl -s -o \u002Fdev\u002Fnull -w '%{http_code}\\n' -H \"Authorization: Bearer $NEW\" \"$API\u002Fv1\u002Fme\"   # 200\n    curl -s -H \"Authorization: Bearer $NEW\" \"$API\u002Fv1\u002Fscopes\" | jq .    # narrow scope list\n\nReport: \"Rotated key id k-92; old revoked (401), new active (200), scopes items:read.\"\n",{"name":5,"description":7},"main","3df1d0d67b30ff15236561f8c0f9f06d33f42dfd","skills\u002Fpayments\u002F0xklen-rotate-and-scope-api-keys",17,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia","https:\u002F\u002Feth2030.com","Hardcore infra. Building @alt-research and applied cryptography.","2026-11-13 02:31:19",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add jiayaoqijia\u002Fcryptoskill --skill rotate-and-scope-api-keys",{"tool":67,"command":68},"bunx","bunx skills add jiayaoqijia\u002Fcryptoskill --skill rotate-and-scope-api-keys",{"tool":70,"command":71},"pnpm","pnpm dlx skills add jiayaoqijia\u002Fcryptoskill --skill rotate-and-scope-api-keys","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-rotate-and-scope-api-keys\u002FSKILL.md",true,[75,79,85],{"path":76,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":16},"LICENSE","许可证",1063,{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"SOURCE.md","REFERENCE","参考文档",351,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-rotate-and-scope-api-keys\u002FSOURCE.md",{"path":86,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":87,"sourceHtmlUrl":88},"TRUST.auto.yaml",2217,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-rotate-and-scope-api-keys\u002FTRUST.auto.yaml",[90,118,137,155,168,178],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":94,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":47},"01M712C436EQYE43342Q4E7GG1","recipe-performance","Diagnose a specific MetaMask user flow's real-app performance and Sentry critical-user-flow telemetry with deterministic mm-harness recipes. Use for CUF boundaries, cold\u002Fwarm\u002Fbackground-resume behavior, latency regressions, lifecycle tags, duplicate or blocking network requests, long tasks, layout\u002Fpaint cost, screen redraws, React rerenders, or browser trace analysis where tests alone cannot prove the real app.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FSKILL.md",[],[98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117],"performance","recipe performance","recipe","mm","sentry","harness","app","deterministic","recipes","flow","cold","critical","analysis","tasks","react","browser","layout","screen","network","metamask",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":122,"licenseFileUrl":123,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":47},"01M70XT2F8A5CQZ81JBP98KSW3","mexc-spot-websocket","MEXC Spot WebSocket workflows for public streams, protobuf handling, depth maintenance, listen keys, and private streams without exposing API keys.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FSKILL.md",[],[127,128,129,33,130,131,132,133,134,34,37,31,135,136],"mexc spot websocket","spot","websocket","workflows","public","listen","streams","depth","maintenance","protobuf",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":122,"licenseFileUrl":141,"sourceHtmlUrl":142,"categories":143,"keywords":144,"publishedAt":47},"01M70XT0MBXN3WZY1BKN0CPNKR","mexc-spot-rest","MEXC Spot REST workflows for public data, signed account requests, orders, wallet\u002Fadmin actions, and secure signing without exposing API keys.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FSKILL.md",[],[145,128,146,147,148,149,150,31,37,34,151,152,153,131,154,130,33],"mexc spot rest","REST","admin","signing","Wallet","requests","actions","secure","data","orders",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":122,"licenseFileUrl":159,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":47},"01M70XSYSVZ2N0N91XCAR2CAK0","mexc-futures-websocket","MEXC Futures WebSocket workflows for public streams, private account\u002Forder\u002Fposition streams, ping\u002Fpong, subscriptions, and depth maintenance.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FSKILL.md",[],[163,164,129,165,166,135,37,167,134,133,131,130],"mexc futures websocket","futures","position","ping","subscriptions",{"skillNo":169,"name":170,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":171,"sourceHtmlUrl":172,"categories":173,"keywords":174,"publishedAt":47},"01M6H0ZWHVE5W04WG2DKQE2SQC","0xklen-version-and-refresh-sanctions-lists","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FSKILL.md",[],[175,176,177],"refresh","0xklen version and refresh sanctions lists","version",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":182,"sourceHtmlUrl":183,"categories":184,"keywords":185,"publishedAt":47},"01M6H0Z28Q3R8J0S799GJQWXM3","verify-tests-cover-changed-lines","Use when a PR adds code that the existing suite may not exercise. Measures patch coverage — the share of newly changed lines hit by tests — before approving.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FSKILL.md",[],[186,187,188,189,190,191,192,42,193,194,195],"tests","cover","verify tests cover changed lines","verify","coverage","pr","exercise","patch","code","share"]