The database was empty, but the logs told another story.
API tokens had been leaking through forgotten endpoints, expired but never revoked, stored in plaintext where they shouldn’t exist. When the audit came, the report was brutal: non-compliance with PCI DSS. For engineers, this isn’t theory. PCI DSS violations mean risk to customers, fines, and potential legal fallout. For systems running payment data, the rules for API token management are as serious as the rules for encryption or access control.
PCI DSS demands strict control over any credential that could be used to access cardholder data. API tokens fall directly into scope. That means they must be generated securely, stored encrypted, rotated often, and revoked the second they are no longer needed. Hardcoding tokens in code repositories? Failing to log token usage? Allowing tokens with unlimited lifetimes? Each of those is a direct path to failing compliance checks.
The first step is inventory. Many systems have tokens scattered across environments, scripts, and old integrations no one remembers. If you don’t know where your API tokens live, you can’t secure them. Once identified, apply encryption at rest and in transit, just as you would for primary account numbers. Ensure token creation uses strong randomness so they can’t be guessed. Limit scope to only the exact API calls required.