How do I manage API keys and consumer access centrally?

To manage API keys and consumer access centrally, set up a dedicated API management layer rather than handling keys directly in each service. The common approach is:

1) Use an API Gateway or API Management platform

Examples: Kong, Apigee, AWS API Gateway, Azure API Management, NGINX + auth service, Tyk.

It should handle:

• API key issuance
• Authentication / authorization
• Rate limiting / quotas
• IP allowlists / blocking
• Logging and analytics
• Key rotation and revocation

2) Maintain a central consumer registry

Create a single source of truth for:

• consumer/app name
• owner/team
• environment (dev/test/prod)
• allowed APIs/scopes
• issued keys / credentials
• status (active, suspended, revoked)

Store this in:

• the API management platform’s developer portal, or
• a central IAM / secrets / database-backed registry

3) Separate identity from access

Prefer:

• OAuth2 / OIDC for user or app identity
• API keys for simple app identification
• JWTs / scoped tokens for fine-grained access

Avoid using raw API keys as the only control for high-security systems.

4) Centralize policy enforcement

Define policies in one place:

• which consumers can call which APIs
• what quotas apply
• what scopes are required
• what headers/claims are needed
• what environments are permitted

Enforce policies at the gateway, not in each backend service.

5) Automate key lifecycle management

Implement workflows for:

• self-service key requests
• approval if needed
• automatic provisioning
• scheduled rotation
• immediate revocation on compromise or offboarding

Track key usage and last-seen activity.

6) Use secure storage and delivery

• Store secrets in a secret manager: HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager
• Never hardcode keys in code or configs
• Deliver credentials only over secure channels
• Encrypt at rest and in transit

7) Add auditing and monitoring

Log:

• who requested/approved a key
• when it was created/rotated/revoked
• which APIs were accessed
• anomaly patterns, such as spikes or geo changes

Send alerts for:

• failed auth bursts
• quota overruns
• unused keys
• suspicious usage

Recommended central model

A good setup looks like this:

Consumer onboarding portal → approval workflow → central credential store / IAM → API gateway enforcement → audit logs / monitoring

Practical rule of thumb

If you need to centrally manage many consumers and APIs, use:

• API Gateway + Developer Portal + Secrets Manager + IAM If you need enterprise governance, choose a full API Management solution.

If you want, I can also give you:

1. a reference architecture,
2. a tool comparison (AWS/Azure/GCP/Kong/Apigee), or
3. a step-by-step implementation plan.