Skip to content

README API Key

Service Name: ReadMe

Service Description: ReadMe is a developer hub platform that helps companies create and manage API documentation. It provides tools for creating interactive API references, guides, and changelogs to help developers understand and use APIs effectively.

Service Address: https://readme.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the organization level through ReadMe's dashboard settings.

Secret Access Scope: Grants programmatic access to ReadMe's API, allowing management of documentation, metrics collection, and other ReadMe platform features.

Secret Revokement URL: https://dash.readme.com/project/{project-name}/api-key

Secret Example: rdme_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Suspicious Activity Investigation Instructions:

  • Review API access logs in the ReadMe dashboard for unusual activity.
  • Check for unauthorized documentation changes or updates.
  • Monitor for unexpected API calls or access patterns.
  • Verify if there are any new API keys created without authorization.
  • Look for documentation changes made from unfamiliar IP addresses.

Mitigation Instructions:

  • Log in to your ReadMe dashboard at https://dash.readme.com/

  • Navigate to your project settings.

  • Select the "API Keys" section.

  • Locate the compromised API key.
  • Click "Revoke" or "Delete" to invalidate the key.
  • Generate a new API key if needed.
  • Update any legitimate applications or services that were using the old key.
  • Consider implementing more restrictive permissions for new API keys.
  • Review and update access controls for your ReadMe project.