Skip to content

Octopus API Key

Service Name: Octopus Deploy

Service Description: Octopus Deploy is a deployment automation server that makes it easy to automate the deployment of ASP.NET applications, Windows services, and databases across your development, test, and production environments.

Service Address: https://octopus.com/

Validation Type: API Auth

IP Allow list: Does not exist

Secret Access Scope: Grants programmatic access to Octopus Deploy resources and allows automation of deployment processes.

Secret Revokement URL: https://octopus.com/docs/octopus-rest-api/api-keys

Secret Example: API-ABCDEF0123456789ABCDEF0123456789

Suspicious Activity Investigation Instructions:

  • Review the Octopus Deploy audit logs for unusual API calls or resource access
  • Check for unauthorized deployments or configuration changes
  • Look for API keys being used from unusual IP addresses
  • Monitor for changes to deployment processes or variables

Mitigation Instructions:

  • Log into the Octopus Deploy web portal
  • Navigate to your user profile
  • Select the API Keys tab
  • Find the compromised API key and click Delete
  • Create a new API key with appropriate permissions if needed
  • Update any applications or scripts that were using the old key