Many Australian small and medium businesses now depend on software connections that customers never see. A website may send an enquiry to a CRM. An accounting platform may connect to a bank feed. An automation tool may create support tickets, update records or send customer notifications.
These connections are useful, but they often rely on API keys, access tokens and service accounts. If one is copied into a chat, stored in a spreadsheet or left active after a project ends, it can give an attacker a quiet path into business systems. API access should be managed with the same care as administrator passwords.
What an API key can allow
An API key is a credential that lets one system communicate with another. Depending on the platform, it may read customer records, create invoices, update website content, download files, send messages or trigger an automated workflow. The key may not look like a normal password, but it still represents authority.
The practical risk is often not a dramatic hacking scene. It may be a forgotten integration, a former contractor’s test key, an automation account with excessive permissions, or a credential included in a public code repository. A small business can have many of these access paths without having a clear inventory.
Where SMEs commonly lose control
- API keys are saved in email, chat messages, shared documents or spreadsheets.
- One powerful administrator key is reused across several automations.
- Test and production systems share the same credentials.
- Keys remain active after a supplier, staff member or software project changes.
- No one records which system owns a key, what it can do, or when it was last rotated.
- Automation platforms can access more customer or financial data than the workflow needs.
A practical API access checklist
1. Build a simple access register
List your websites, CRM, accounting, cloud storage, payment, marketing and workflow platforms. For each connection, record the owner, purpose, data accessed, supplier contact, environment and recovery process. Do not put the secret value itself in the register.
2. Use a proper secrets store
Keep API keys in a password manager, secrets manager or platform vault designed for credentials. Limit who can view or change them. Avoid putting live secrets in source code, screenshots, tickets, email or shared notes.
3. Reduce permissions
Give each integration only the access it needs. A workflow that reads a CRM contact should not automatically be able to delete records. A website publishing connection should not also have access to unrelated finance data. Separate keys by system, purpose and environment where the platform supports it.
4. Rotate and revoke
Set a review date for every important key. Rotate credentials after staff changes, supplier changes, suspected exposure or major workflow updates. Revoke old keys rather than leaving them available as a hidden fallback.
5. Monitor use and test recovery
Review provider logs for unusual locations, unexpected volumes and actions outside normal hours. Keep a documented recovery path for each critical integration. Test whether the business can disable a compromised key, issue a replacement and restore the workflow without losing customer data.
How to introduce controls without slowing the business
Start with the integrations that can send money, change customer records, publish to the website, access personal information or affect daily operations. Protect those first, then work through lower-risk connections. Make one person accountable for the register, but ensure at least one other authorised person can recover the system.
For new automation projects, ask three questions before connecting anything: what data does the workflow need, what actions can it take, and how will access be removed? These questions are simple, but they prevent many uncontrolled connections from becoming permanent.
How Xpansion Technologies can help
Xpansion Technologies helps Australian businesses review software integrations, API access, cloud permissions, websites, CRM workflows and automation platforms. The goal is practical control: fewer unknown credentials, clearer ownership, safer data handling and a recovery process the team can actually follow.
Sources
- Cyber.gov.au: Securing your accounts
- Cyber.gov.au: Essential Eight
- OAIC: Securing personal information
- OWASP: API Security Top 10
Leave a comment