Rotating a USPTO API Key Requires Sending an Email

##Background

While reviewing old automation, I checked how the USPTO Open Data Portal handles API-key rotation. Account holders rotate keys during scheduled maintenance, after rebuilding an application, when operators change, or after a possible leak. A routine rotation has three steps: create a replacement key, update the application, and deactivate the old key.

The USPTO, however, requires an email to be sent. Its FAQ says:

Can I have multiple API keys with one ID.me account?

No. The ID.me account integration with your USPTO.gov account is a one-to-one connection. You can only integrate your ID.me account into one USPTO.gov account. If you need to replace your API Key, email data@uspto.gov a request for a new API Key https://help.id.me/hc/en-us/articles/4412245504407-USPTO-and-ID-me on your personal Manage API Key page.

The portal includes a self-service control for deactivating the current key.

##Problem

ID.me links one human identity to one USPTO.gov account. The FAQ treats that identity link as a reason to limit the user to one API key. Several applications may depend on the same account, and each application may require independent key rotation or deactivation. The one-key policy and email-only replacement process are crazy.

The one-key policy forces a choice between failed requests and continued use of a possibly leaked key. Deactivating the current key immediately causes authenticated requests to fail until the USPTO issues a replacement key and the user installs the new key. Keeping the current key active avoids failed requests while leaving the possibly leaked credential usable. The FAQ gives no turnaround time for a replacement request.

The email-only replacement process discourages routine rotation. Leaving the current key alone avoids administrative delay and failed requests. The path of least resistance is to keep using the same credential until a suspected compromise forces a change.

##Solution

The portal should let users create multiple named keys and show each key’s creation date, last use, and expiration date. Overlapping keys let users update each application before deactivating the old key.

##Closing

On July 23, the USPTO announced a new homepage design. The director praised the “extensive time and effort” spent improving navigation. I’m glad the USPTO got its fancy new splash page. I would trade a little of that effort for a Create replacement key button.