--- title: Secure Bots and Service Account using x509 Certificates description: Static keys and tokens used for bot and service account authentication carry inherent security risks: infinite lifetime by default, insecure storage, and no... canonical: https://daily.dev/posts/secure-bots-and-service-account-using-x509-certificates-6mrvurhpd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Secure Bots and Service Account using x509 Certificates | daily.dev og:description: Static keys and tokens used for bot and service account authentication carry inherent security risks: infinite lifetime by default, insecure storage, and no... og:url: https://daily.dev/posts/secure-bots-and-service-account-using-x509-certificates-6mrvurhpd og:image: https://api.daily.dev/og/posts/6mrvURHpd.png og:image:alt: Secure Bots and Service Account using x509 Certificates og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Secure Bots and Service Account using x509 Certificates **[Teleport](https://daily.dev/sources/teleport)** · 7 min read · 0 upvotes · 0 comments ## Summary Static keys and tokens used for bot and service account authentication carry inherent security risks: infinite lifetime by default, insecure storage, and no support for multi-factor authentication. Drawing on real-world CI/CD breach examples (NCC Group findings, the Heroku/Travis-CI OAuth token incident), the case is made for replacing static credentials with short-lived, auto-renewing x509 certificates. Teleport's Machine ID feature is presented as an implementation of this approach, issuing ephemeral certificates that renew automatically and can be instantly revoked if compromised. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why are static API keys and tokens risky for bot or service account authentication? Static credentials have infinite validity by default, giving attackers unlimited time to exploit stolen keys. They're often stored insecurely in environment variables or text files readable by any process under the same user, and they can't use multi-factor authentication since bots can't perform out-of-band actions like approving push notifications or entering TOTP codes. _Teams weighing authentication strategies for CI/CD pipelines can track security approaches like this on daily.dev._ ### What is Teleport Machine ID and how does it secure service account access? Machine ID is a Teleport feature that issues short-lived, ephemeral x509 certificates to bots and service accounts instead of static credentials, automatically renewing them in the background via a certificate renewal bot. It also supports on-air certificate locking to immediately revoke access if a certificate is compromised, and integrates with existing RBAC, SSO, and audit features. _Engineers evaluating machine identity tooling can follow developments like Machine ID on daily.dev._ ## Similar posts on daily.dev - [Stop managing SSH keys on every server and switch to Teleport](https://daily.dev/posts/stop-managing-ssh-keys-on-every-server-and-switch-to-teleport-zoja48gov) · All Things Open · 0 upvotes · 0 comments - [Why short-lived systems need stronger identity governance](https://daily.dev/posts/why-short-lived-systems-need-stronger-identity-governance-2mp3kjrvi) · CSO Online · 0 upvotes · 0 comments - [Why Organizations Are Abandoning Static Secrets for Managed Identities](https://daily.dev/posts/why-organizations-are-abandoning-static-secrets-for-managed-identities-l5n3swmh4) · The Hacker News · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/secure-bots-and-service-account-using-x509-certificates-6mrvurhpd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Secure Bots and Service Account using x509 Certificates","url":"https://daily.dev/posts/secure-bots-and-service-account-using-x509-certificates-6mrvurhpd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/secure-bots-and-service-account-using-x509-certificates-6mrvurhpd"},"datePublished":"2026-08-23T12:22:06.732Z","dateModified":"2026-08-23T12:44:00.025Z","description":"Static keys and tokens used for bot and service account authentication carry inherent security risks: infinite lifetime by default, insecure storage, and no...","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/secure-bots-and-service-account-using-x509-certificates-6mrvurhpd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,secrets-management","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Secure Bots and Service Account using x509 Certificates"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/secure-bots-and-service-account-using-x509-certificates-6mrvurhpd#faq","mainEntity":[{"@type":"Question","name":"Why are static API keys and tokens risky for bot or service account authentication?","acceptedAnswer":{"@type":"Answer","text":"Static credentials have infinite validity by default, giving attackers unlimited time to exploit stolen keys. They're often stored insecurely in environment variables or text files readable by any process under the same user, and they can't use multi-factor authentication since bots can't perform out-of-band actions like approving push notifications or entering TOTP codes. Teams weighing authentication strategies for CI/CD pipelines can track security approaches like this on daily.dev."}},{"@type":"Question","name":"What is Teleport Machine ID and how does it secure service account access?","acceptedAnswer":{"@type":"Answer","text":"Machine ID is a Teleport feature that issues short-lived, ephemeral x509 certificates to bots and service accounts instead of static credentials, automatically renewing them in the background via a certificate renewal bot. It also supports on-air certificate locking to immediately revoke access if a certificate is compromised, and integrates with existing RBAC, SSO, and audit features. Engineers evaluating machine identity tooling can follow developments like Machine ID on daily.dev."}}]} ```