Comment by mslaviero

We look at several factors before adding new Canarytoken API key types to canarytokens.org:

1. Can we create/remove keys programmatically at scale cheaply? Most sites aren't geared up to handle tens or hundreds of thousands of API keys tied to a single account. If the per-account limits are low then we have to build infra to manage multiple accounts.

2. Can we defang the keys so that there is no risk to them being discovered?

3. Does the service provide a near real-time audit log to pinpoint when an individual key was used? Ideally the audit log also includes IP information.

4. Does the service provide a mechanism to trigger audit events, or do we need to poll the service for the audit logs?

5. Would most attackers recognise the API key and want to try it?

Most services fail one or more of these.