九種憑證、一條別名邊界：跨應用程式、API 與 AI 智能體的憑證指南

JWTs, API Keys, OAuth Tokens, and Six More Credential Types: What Changes When DevFortress Moves the Alias Boundary Underneath Them

Introduction

Nine different credential types - JWTs, API keys, OAuth tokens, session cookies, cloud IAM credentials, SSH keys, database credentials, webhook signing secrets, and mTLS client certificates - sit behind almost every system built in the last two decades. They look different on the wire: a signed token, a static string, a cookie, a certificate. Structurally, they're the same problem wearing different costumes. Each one is a bearer value that some verifier - a gateway, a database, an API, a peer on the other end of a TLS handshake - decides to trust or reject. Harden the verifier's checks and you close the gaps attackers currently know about. You do nothing for the day a value is captured anyway, through a channel nobody modeled as an exfiltration path, a dependency nobody audited, or a vulnerability nobody has found yet.

Documented in Production

Each credential type below has its own story of how a hardening checklist got skipped in practice.

JWTs - GitHub Copilot's CamoLeak vulnerability (CVE-2025-59145) let a prompt-injection payload exfiltrate private repository contents through Copilot's own image-proxy channel, using the session's existing JWT the entire time. The token itself was never cracked - it simply worked for whoever presented it.

API Keys - Toyota's T-Connect service exposed a hardcoded API key for roughly five years before discovery. GitGuardian found 12.8 million secrets exposed on public GitHub in 2023 alone, 91.6% of them still valid five or more days after detection.

OAuth Tokens - A maliciously published package abused Vercel's OAuth integration to harvest access tokens from downstream users. Cambridge Analytica's 2014-2015 harvesting of Facebook user data remains the canonical example of an API token used far beyond what any user consented to.

Session Cookies - CircleCI's December 2022 breach began when malware stole a single 2FA-backed SSO session cookie; that one cookie cascaded into every secret CircleCI stored for every customer. Okta's HAR-file breach the following year used stolen diagnostic files to hijack active admin sessions at five confirmed customer organizations.

Cloud IAM Credentials - Capital One's 2019 breach traced back to an SSRF attack that reached the EC2 instance metadata service and retrieved over-permissioned temporary IAM credentials.

SSH Keys - The same CircleCI breach cascaded into SSH keys: once the attacker reached a production process, the encryption keys extracted from it decrypted every category of secret CircleCI stored.

Database Credentials - LastPass's two-stage breach is the clearest case of a credential surviving capture: a stolen encrypted S3 key sat inert for four months until a second, unrelated breach supplied the decryption key needed to use it. LastPass agreed to a $24.45 million class-action settlement in late 2025.

Webhook Signing Secrets - These rarely make headlines on their own; they fail quietly, as one more string inside the same secrets-sprawl problem.

mTLS Client Certificates - Okta's AD/LDAP Delegated Authentication feature had a bcrypt truncation bug that let any password authenticate for usernames 52+ characters long - active for three months before discovery.

What Changes When Each One Is Aliased

This guide walks through the known, documented abuse pattern for each credential type, shown as working vulnerable-vs-hardened code - and then what changes once the credential itself is aliased, so a captured value resolves to nothing usable rather than handing an attacker a working credential.

• JWTs - algorithm allowlists and audience checks close known bypasses, but a captured token is still just a bearer value until it's aliased.
• API Keys - scoped, hashed, rotating keys shrink the blast radius; aliasing is the backstop for the day one leaks anyway.
• OAuth Tokens - PKCE and refresh-token rotation are the RFC 9700 baseline; aliasing is what's still standing on the day a token leaks regardless.
• Session Cookies - regeneration, cookie flags, and timeouts harden issuance; aliasing catches the moment an identifier is captured anyway.
• Cloud IAM Credentials - STS and least privilege shrink blast radius and lifetime; aliasing catches exfiltration from memory or a compromised metadata endpoint.
• SSH Keys - short-lived certificates beat long-lived key pairs; aliasing removes the need for manual authorized_keys cleanup.
• Database Credentials - dynamic secrets and scoped roles limit reach; aliasing is what survives a credential pulled from process memory.
• Webhook Signing Secrets - signature verification and constant-time comparison close known gaps; aliasing protects against the secret itself leaking from a log or dashboard.
• mTLS Client Certificates - revocation checks and SPIFFE-grade SVIDs are the first line; aliasing catches key material extracted from a compromised process.

None of this replaces getting the fundamentals right. Those are first-line defenses and they still matter regardless of what sits underneath them. Aliasing is about what's left standing on the day one of them has a gap nobody's found yet.

This is a condensed version. The full post has the working vulnerable-vs-hardened code for all nine credential types, plus the actual devfortress-sdk implementation pattern for each.