A Solution to Rampant Token Theft: Proof of Possession (opens in new tab)

Static API keys in environment variables and files are too easy to steal. A better model is proof-of-possession, where every API call must be signed by a non-exportable private key that is available only through a constrained signing interface.