Client ID and Secret Validity Enhancement

Dear Team,

During our recent RBI audit, it was noted that the current configuration of client IDs and secrets within IBM API Connect lacks adequate controls around their validity period. This raises concerns regarding security and compliance with regulatory standards, specifically in relation to the management of sensitive credentials.

Current Situation

Client ID and Secret Management: The client ID and secret are essential for authenticating applications and ensuring secure access to APIs. However, the current setup allows these credentials to remain valid indefinitely unless manually revoked.

Security Risks: Long-lived client IDs and secrets increase the risk of unauthorized access, especially if they are exposed or compromised. If an application is no longer in use, its credentials may remain valid, potentially allowing for misuse.

Proposed Enhancement

 We propose implementing a mechanism for defining a validity period for client IDs and secrets in API Connect. This feature should include:

Configurable Expiry Settings:

Allow administrators to set expiration dates for client IDs and secrets based on organizational policies or regulatory requirements.

Provide options for automatic expiration after a specified period (e.g., 30, 60, 90 days).

Notification Mechanism:

Implement a notification system to alert administrators and developers when credentials are nearing expiration.

Provide a mechanism for seamless renewal of credentials prior to expiration.