# Ensure API Credentials Have an Expiration Date

- Source: https://support.icompaas.com/support/solutions/articles/a_1791826022452201-ensure-api-credentials-have-an-expiration-date
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [OVH Cloud](https://support.icompaas.com/support/solutions/c_1791819364512367) › [checks](https://support.icompaas.com/support/solutions/folders/f_1791819376721251)
- Last updated: 2026-10-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure every OVHcloud API credential (application key, application secret, and consumer key) is created with a limited validity period instead of an unlimited one. Long-running automation should use credentials that are renewed on a schedule.

**Rationale**

API credentials give programmatic access to the account with the rights they were granted. Credentials without an expiry stay valid forever, even after the script or person using them is gone, and are often forgotten in code, CI systems, or laptops. A limited validity makes sure leaked or forgotten credentials stop working on their own.

**Impact**

-   Leaked or forgotten credentials stop working automatically
    
-   Encourages regular review of API access
    
-   Automation must renew its credentials before they expire
    

**Default Value**

When creating API keys, you choose the Validity, and an unlimited validity can be selected.

**Pre-Requisites**

-   Access to the OVHcloud account
    
-   A list of tools that use OVHcloud API credentials
    

**Test Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Identity, Security & Operations.
    
3.  Select API keys.
    
4.  Review each API key and its expiration date.
    
5.  Alternatively, use the OVHcloud API console at [https://eu.api.ovh.com/console/](https://eu.api.ovh.com/console/) (or your region's console). Run GET /me/api/credential, then GET /me/api/credential/{credentialId} for each ID, and check the expiration field.
    
6.  If any credential has no expiration date, follow the implementation steps.
    

**Implementation Steps**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Identity, Security & Operations.
    
3.  Select API keys.
    
4.  Select Create API key, enter a name and description, choose a limited Validity period, and set only the Rights the tool needs.
    
5.  Update the tool to use the new application key, application secret, and consumer key.
    
6.  Delete the old credential from the ⋯ menu, or run DELETE /me/api/credential/{credentialId} in the API console.
    

**Backout Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Identity, Security & Operations.
    
3.  Select API keys.
    
4.  If a tool stops working, create a new API key for it and update the tool.
    

**Reference**

-   [https://help.ovhcloud.com/csm/en-gb-api-getting-started-ovhcloud-api?id=kb\_article\_view&sysparm\_article=KB0042784](https://help.ovhcloud.com/csm/en-gb-api-getting-started-ovhcloud-api?id=kb_article_view&sysparm_article=KB0042784)
    
-   [https://support.us.ovhcloud.com/hc/en-us/articles/360018130839-First-steps-with-the-OVHcloud-API](https://support.us.ovhcloud.com/hc/en-us/articles/360018130839-First-steps-with-the-OVHcloud-API)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.