Why are API keys not bound to an IP address allow list? I never see this option available in API services. Failing that, you should also receive an email whenever a new IP address attempts to use your API key. API keys should double up as canary tokens.

@BuildHackSecure Because I and many others don't have a static IP address at home. Which coincidentally is why I cannot manage my domains with Namecheap from home.

@francip Also how often does it really change? I’ve always had dynamic at home and it barely ever changes.

@BuildHackSecure @francip every dial in, with forced 24h disconnect that is once per day.

@TweetEagle1 @francip

@BuildHackSecure @TweetEagle1 @francip My PPPoE based FTTH service still did this, in 2025

@schuyler_t @TweetEagle1 @francip That's crazy, that would definetly be a pain.

@BuildHackSecure @TweetEagle1 @francip One of the appeals to OpnSense to me was the built in cloudflare DDNS updater 😅