API Keys vs OAuth
Static API keys are the fastest to adopt and the hardest to govern. OAuth adds refresh flows but gives you per-agent revocation. In multi-agent hubs the default should be OAuth-like principals: one identity per agent, scoped to exactly what it needs.
Never embed keys in skill manifests or client bundles. Inject them at runtime from a vault so secrets never appear in logs, errors, or version control.
Pro Tip: Rotate Early and Often
Issue short-lived tokens and rotate master keys on a schedule. The blast radius of a leaked short-lived token is minutes, not months.
Least Privilege
Scoped principals mean a compromised agent can read its own data and nothing else.
Audit Trails
Token usage logs make it possible to trace which agent accessed which resource, and when.
Request Shape
Authorization: Bearer <short-lived-jwt>
X-Agent-Id: skill-runner-042
X-Scope: schema:read