:white_check_mark: Automate your key and secret validation workflows

:cowboy_hat_face: Over 30 different providers

:robot: Export to JSON, audit via CSV

:key: Keyscope

Keyscope is a key and secret workflow (validation, invalidation, etc.) tool built in Rust, powered by service_policy_kit.

Current workflows supported:

• Validation

🦀 Why Rust?

• With Rust, "If it compiles, it works." and also, it compiles to many platforms.
• Rust is fast, has no VM, or unnecessary cruft (typically 5-8mb binaries with LOTS of code and libraries).
• Multi purpose, safe, and generalistic - makes for healthy and expressive mission critical code. Adding code or abstraction doesn't increase bloat, doesn't hurt performance, doesn't increase chance for bugs in a radical way (less edge cases).
• Amazing package manager: Cargo. Productive installing and running of tasks and examples.
• Rust is getting headlines in the security community as the go-to language for security tools. Equally interesting is offensive security + Rust here and here.

:rocket: Quick Start

Grab a release from releases, or install via Homebrew:

brew tap spectralops/tap && brew install keyscope

Using keyscope

You can try out validating a key for a provider, say, Github (assuming the key is in the GITHUB_TOKEN environment variable):

$ keyscope validate github $GITHUB_TOKEN

You can see which other providers are supported by running:

$ keyscope validate --list

  .
  :
  .

twilio:validation
keyscope validate twilio -p twilio_1 -p twilio_2

twitter:validation
keyscope validate twitter -p twitter_1

zendesk:validation
keyscope validate zendesk -p zendesk_1 -p zendesk_2

Total 44 providers available.
$

And what parameters are required for a certain provider by running (say, stripe):

$ keyscope requirements stripe

provider stripe requires:
 - param: p1
   desc: stripe key
$

Finally the general structure of the validate command is:

$ keyscope validate PROVIDER -p PARAM1 -p PARAM2 .. -p PARAM_N

:white_check_mark: Validation: key should be active

You can validate a specific provider like so:

$ keyscope validate twilio -p $TWILIO_KEY

With the general pattern of:

$ keyscope validate PROVIDER -p PARAM1 -p PARAM2 ...

The number of keys/params would change based on authentication type:

• Bearer - usually just a single key (token)
• Basic Auth - usually 2 keys: user, password
• OAuth - usually 2 keys: client_id, client_secret
• And others.

Each provider in Keyscope will tell you what it requires using requirements:

$ keyscope requirements twilio

You'll get a report:

$ keyscope --verbose validate stripe -p $STRIPE_KEY

✔ stripe:validation: ok 766ms

Ran 1 interactions with 1 checks in 766ms

Success: 1
Failure: 0
  Error: 0
Skipped: 0

And an executable exit code that reflects success/failure.

You can use the --verbose flag to see API responses:

$ keyscope --verbose validate stripe -p $STRIPE_KEY

✗ stripe:validation: failed 413ms
      status_code: 200 != 401 Unauthorized

Ran 1 interactions with 1 checks in 413ms

Success: 0
Failure: 1
  Error: 0
Skipped: 0

In this case the exit code is 1 (failure).

:x: Validation: key should be inactive

When you are validating keys that are supposed to be inactive, you can use the flip flag. In this mode, a failed API access is a good thing, and the exit code will reflect that.

$ keyscope --flip validate stripe -p $STRIPE_KEY

✔ stripe:validation: ok 766ms

Ran 1 interactions with 1 checks in 766ms

In this case, the key is active - which is bad for us. Using --flip, the exit code will be 1 (failure).

:runner: Setting up a validation job

Audit active keys

You can set up a CI job (or other form of scheduled job you like) to perform an audit, by reading all parameters from a dedicated CSV file like so:

$ keyscope validate --csv-in report.csv

The format of the CSV that you need to prepare should include a header line and look like this:

provider,key1,key2,key3
twilio,tw-key1,,,

You can specify as many key columns as you like, as long as you provide an empty value for providers which don't have that many keys, and all rows contain the same amount of cells.

Audit inactive keys

If you have a dump of keys from your vault that are stale have expiry and should have been rotated, you want to test that they are all stale:

$ keyscope --flip validate --csv-in my-key-audit.csv

:link: Supported providers

We're always adding new providers, keep a link to this list or watch this repo to get updated.

We use our service_policy_kit library to specify interactions with services and their policies, if you find a service not in this list feel free to open an issue or contribute back.

keyscope validate tester -p TESTER_1 -p TESTER_2

keyscope validate infura -p INFURA_1

keyscope validate covalenthq -p COVALENTHQ_1

keyscope validate asana -p ASANA_1

keyscope validate bitly -p BITLY_1

keyscope validate ipstack -p IPSTACK_1

keyscope validate localytics -p LOCALYTICS_1 -p LOCALYTICS_2

keyscope validate algolia -p ALGOLIA_1 -p ALGOLIA_2 -p ALGOLIA_3

keyscope validate branchio -p BRANCHIO_1 -p BRANCHIO_2

keyscope validate browserstack -p BROWSERSTACK_1 -p BROWSERSTACK_2

keyscope validate buildkite -p BUILDKITE_1

keyscope validate datadog -p DATADOG_1

keyscope validate github -p GITHUB_1

keyscope validate github-ent -p GITHUB-ENT_1 -p GITHUB-ENT_2

keyscope validate dropbox -p DROPBOX_1

keyscope validate gitlab -p GITLAB_1

keyscope validate heroku -p HEROKU_1

keyscope validate mailchimp -p MAILCHIMP_1 -p MAILCHIMP_2

keyscope validate mailgun -p MAILGUN_1

keyscope validate pagerduty -p PAGERDUTY_1

keyscope validate circleci -p CIRCLECI_1

keyscope validate facebook-access-token -p FACEBOOK-ACCESS-TOKEN_1

keyscope validate salesforce -p SALESFORCE_1 -p SALESFORCE_2

keyscope validate jumpcloud -p JUMPCLOUD_1

keyscope validate saucelabs-us -p SAUCELABS-US_1 -p SAUCELABS-US_2

keyscope validate saucelabs-eu -p SAUCELABS-EU_1 -p SAUCELABS-EU_2

keyscope validate sendgrid -p SENDGRID_1

keyscope validate slack -p SLACK_1

keyscope validate slack-webhook -p SLACK-WEBHOOK_1

keyscope validate stripe -p STRIPE_1

keyscope validate travisci -p TRAVISCI_1 -p TRAVISCI_2

keyscope validate twilio -p TWILIO_1 -p TWILIO_2

keyscope validate twitter -p TWITTER_1

keyscope validate zendesk -p ZENDESK_1 -p ZENDESK_2