Restrict API keys with password access to specific password folders (so a breached integration can’t expose every password).

Hi Hudu team,

Integrations like CyberQP QuickPass password rotation tools need API access to read and update passwords in Hudu. Today, once an API key is given the “view passwords” permission, it gets full access to all passwords, including viewing, editing, and deleting. A key can be limited to a company, but not beyond that. If an integration vendor is breached, an attacker could reach every password in the scope of that key.

Why now: Last week’s compromise of ConnectWise’s cloud backup gave attackers access to the Microsoft tenants connected to it. It made us look at every vendor with access to our data, and a vendor with broad password access in Hudu is one of our biggest exposures.

Request: add a folder limit to API keys, the same way we can limit them to a company today. An admin could restrict a key to:

• A folder belonging to one specific company, or

• A global folder, giving the key access to that folder across all companies

The key would only be able to access passwords inside the folders it’s been granted.

Also requested: let admins edit existing API keys, including permissions, company and folder limits, and IP restrictions. Today, tightening a key (such as adding an IP restriction or updating an IP) means deleting it and creating a new one, which also means reconfiguring the integration.

Also helpful: separate view, create, edit, and delete permissions for each availble asset, including passwords only with no asset access instead of one “view passwords” toggle that grants everything.

This would let MSPs use password automation without making every vendor a single point of failure.

Thank you!