01 What happened
SAP BTP service keys are credentials for external clients without IP restrictions. They never expire (except X.509) and can be used from anywhere on the internet. Regular rotation is essential.
02 Key details
- Service keys have no IP restrictions and never expire (unless X.509); anyone with clientid/clientsecret can request tokens from anywhere on the internet.
- Zero-downtime pattern: add a new key, switch consumers, wait a grace period, then delete the old key.
- Store credentials in a dedicated secret manager (Vault, Key Vault, etc.); never in Git, images, or chat.
- Give each consumer its own key and automate rotation with a scheduled script; always test on non-production first.
03 Why it matters
A single leaked service key can compromise an entire BTP instance. Leaks are silent; rotation limits exposure and prevents long-term abuse.
04 Who it matters to
SAP HANA administrators and SOCs (Security Operations Centers).
Original source