Deleted API key still active

Started by Tipsy [1160609] on 3 Nov 2021 in Bugs & Issues.

19 replies · 401 views · thread synced 23 Sep 2026 · 6 days ago · View on torn.com

About this thread

Posts archived: 20 / 20 posts (100%) · the total is Torn's reply count + the opening post at the last fetch

Counted by TornLife from the archived posts.

Archived posts: 20
Discussion span: 3 Nov 2021 → 4 Nov 2021
People posting: 5
Likes on archived posts: 11
Posts by staff, officers and moderators: 7
Authority score: 61 / 100
Historical score: 33 / 100
Story score: 45 / 100
Engagement score: 62 / 100

Most-liked replies

Chedburn [1] Admin · 1 likes · 4 Nov 2021
I'll need Pavel to check this.
Chedburn [1] Admin · 1 likes · 4 Nov 2021
Looks like that's sorted then, thanks for your help with tracking this down.
CloudJumper [1636201] · 1 likes · 4 Nov 2021
Reconfirming.

Tipsy [1160609] 3 Nov 2021, 08:21 TCT · #1 · edited

Hi! I created a new limited access API key a couple of hours ago to test something quickly and then deleted it about 10 minutes later.

I used it to log into a couple of things after making it (TornTools, another extension and Torn Stats) and now two hours after deleting it these applications are still happily chugging along using it. It's no longer visible in my API control panel and none of the API calls from those applications are being logged against my active key yet they are all returning live results.

I've also been able to log into yata and doctorn with the key after deleting it and both of those are having no issues with it. I've since made two other keys, logged into a few things and then deleted them and both times those keys have immediately been deactivated.

Could I please get someone to check out this rogue key? It appears to be deleted from my end but apparently it has other ideas.

Thanks!

06:21:33 - 03/11/21 You added a Limited Access API key with the name TornTools
06:27:50 - 03/11/21 You deleted a Limited Access API key with the name TornTools

EDIT: Possibly unrelated, but the API key that I consider to be my "usual" key is quite old, it's been a fair amount of time since I last reset it. I'm not sure if this would make a difference but I guess my main concern is the fact that I have an active key which I can't actually see

someotheradmin [1748048] Tester 3 Nov 2021, 11:14 TCT · #2

Fixed and the fix will be live soon. Also FYI deleted keys were available only up to a minute after deletion

Tipsy [1160609] 3 Nov 2021, 16:22 TCT · #3

Thanks! I will update when the key stops working :)

someotheradmin [1748048] Tester 3 Nov 2021, 17:20 TCT · #4

You mean, the deleted key? Is it kf***************** ?

Tipsy [1160609] 3 Nov 2021, 22:23 TCT · #5 · edited

No, that is my working key.

I deleted a key that was 4B**************** and that key doesn't show in my API control panel but it's still working. I deleted it about 16 hours ago and as of now my scripts are all still able to use it

someotheradmin [1748048] Tester 4 Nov 2021, 10:43 TCT · #6 · edited

It's not really deleted. ~~Pavel could you please check? The key is not deleted but apparently it is not visible~~
Seems an app key. Joe could you please check this

Chedburn [1] Admin Developer 4 Nov 2021, 10:46 TCT · #7

I'll need Pavel to check this.

Tipsy [1160609] 4 Nov 2021, 10:49 TCT · #8 · edited

Thanks for looking into it :)

It's obviously not deleted but from where I'm sitting, it should have been deleted. I requested that it be deleted the same way as I've deleted other keys and my activity log shows that I deleted it (pasted in my original post) so it sounds like maybe something went wrong or there was an error somewhere in that process

Tipsy [1160609] 4 Nov 2021, 11:01 TCT · #9

Thank you!

Chedburn [1] Admin Developer 4 Nov 2021, 12:11 TCT · #10

The key's been manually removed for you, we're still looking in to what happened here. Thanks.

Tipsy [1160609] 4 Nov 2021, 12:13 TCT · #11 · edited

Thanks, that one has stopped working, but now there's a different one there that I can't see either.

I'm not sure if this is one I've made or not, I don't remember it but I'm starting to get a bit confused, lol. It's the same as before, able to read my info through the api and I can't see it on my API control panel. I'm only seeing it in the first place because doctorn and other extensions are detecting it automatically.

xj**************

CloudJumper [1636201]Staff 4 Nov 2021, 12:29 TCT · #12

Reconfirming.

Chedburn [1] Admin Developer 4 Nov 2021, 12:46 TCT · #13

I don't understand how TornTools or DocTorn are able to detect an API key that should be entirely hidden from view.

IceBlueFire [776] Officer Officer 4 Nov 2021, 12:54 TCT · #14

For a brief time during the roll out of the new API panel, i had noticed that i had a different key listed in my normal spot (and worked), but my normal key was still active. After the rollout had finished, that rogue key was gone and my normal key was back again. Is it possible that these scripts perhaps picked up that key and stored it? I have no idea what that "temporary" key was or if it's still somehow active, but that's the only guess i've got.

Tipsy [1160609] 4 Nov 2021, 12:56 TCT · #15

I've got no idea either

[image: i.gyazo.com]

Chedburn [1] Admin Developer 4 Nov 2021, 13:02 TCT · #16

Can you check that page again please? Does DocTorn still see that hidden key?

Tipsy [1160609] 4 Nov 2021, 13:12 TCT · #17 · edited

Tipsy [1160609] 4 Nov 2021, 13:12 TCT · #18

When you first asked it was still there but I've just refreshed the page again after typing a reply and it's disappeared now

Chedburn [1] Admin Developer 4 Nov 2021, 13:21 TCT · #19

Looks like that's sorted then, thanks for your help with tracking this down.

Tipsy [1160609] 4 Nov 2021, 13:24 TCT · #20

No worries, thank you! Any chance that you can please delete that second key that it was coming up with? I can't delete it because it's not visible, and it probably doesn't make sense to have active keys laying around that I can't see the logs of.

Thanks again :D