RFC 8959 / START HERE
Secret-token URIs, before the details
Secret-token is a URI scheme name, not an acronym. URI means Uniform Resource Identifier.
It marks a generated secret, such as an API key, with a recognizable secret-token: prefix. A bearer token can be used by whoever possesses it without a separate proof of cryptographic-key possession.
The idea in one picture
Mark a secret
Notice a copy
Handle with care
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
It helps tools identify accidental leaks into source code or commits. It does not encrypt the secret or define a complete authentication or scanning service.
A familiar example
A configured repository can refuse a commit containing a fictional secret-token:demo-key value. A real issued token must later be used as the entire unchanged string; removing its marker is not safe secret handling.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Recognize an accidental secretA bearer token lets any holder use it without proving possession of a separate cryptographic key. A recognizable URI prefix helps tools notice generated API keys before an accidental disclosure.→
- Build the token from allowed charactersThe grammar is a scheme name, a colon, and one or more pchar characters. pchar comes from URI syntax: letters, digits, selected punctuation and valid percent-encoded octets.→
- Keep the entire issued string unchangedGeneration and later authentication use the entire URI, character for character and case sensitively. Ordinary URI normalization does not justify changing an authentication token.→
- Understand the security limitsA recognizable marker is a handling aid, not encryption, randomness or a complete security system. Registration status and publication status also describe different things.→
- Separate registration from securityThe URI registry records what a scheme name means. Its registration status is separate from the RFC publication category, and neither makes a token secure.→
This introduction explains RFC 8959 (2021). Read the original RFC ↗