Every system you build that uses an API token is a potential privacy breach waiting to happen. Tokens might not carry personal data themselves, but the access they grant can expose user information. Under GDPR, that matters. A lot. If an API token can be used to access EU personal data without proper controls, it falls under GDPR compliance requirements.
The core principle is simple: API tokens that touch personal data must be treated as personal data gateways. They must be protected with the same rigor as passwords. That means encryption at rest, restricted scope, expiration, rotation, and—critically—auditable access logs.
Storing tokens in plaintext in your codebase or configuration files is reckless. Use secure vaults with granular access control. Ensure token scopes match the minimum permissions necessary for the task. Lifetime should be short, with automatic expiration. Rotation policies should be documented and automated.
Under GDPR’s accountability principle, you must be able to show exactly how tokens were created, used, and retired. If a token was compromised, you must know what data could have been accessed and by whom. Logging token use is not optional—it’s essential evidence for compliance.