An API Key Is Not Authority.
Hand an agent an API key and it can reach the endpoint. That is access. It is not the right to make the call.
A key proves the caller can reach the API. It never proves the caller should have made the call.
What a key gives you
A credential opens a channel to a system.
- Access to an API, often with coarse scopes attached.
- A caller the backend will accept and rate-limit.
- A bearer token — whoever holds it, gets in.
Keys are the plumbing of every integration. But a key is a static grant of reach, and reach is not judgement about a specific action.
Where it stops
A key says the caller may reach this API; it never weighs this action, now, for this purpose.
Scopes narrow which endpoints a key touches, but they are set at issue time and blind to context. The key that lets an agent read a ledger to summarise it is the same key that lets it move funds if the scope was drawn too wide — and a leaked or over-broad key carries its full reach to whoever holds it. Static reach cannot express "allowed for this principal, in this purpose, until this expiry."
- It grants reach; it never grants a per-action verdict.
- It is context-free — same key, any request, any time.
- A valid key on a wrongful action still authorises nothing.
The line
Authority is decided per action, against a live delegation, at the boundary.
KYE Protocol™ treats the key as mere access and asks the real question: does the principal behind this call hold delegated authority for this action, within purpose and scope, right now? It returns admit or deny and seals the verdict into a replay-verifiable Evidence Pack™. That is Authority Finality™ — the difference between can-reach and may-act, settled before the side effect.
Honest scope
KYE Protocol™ proves authority, not secrets management.
Rotating, vaulting, and scoping keys is still essential hygiene — KYE Protocol™ does not replace it. It sits above the key and supplies the entitlement decision a bearer token can never carry, bound to the principal and provable afterward. Keep the key. Add the authority.
A key proves the caller can reach the API. It never proves the caller should have made the call.