This Key Will Self-Destruct: An Open Standard for Revocable API Keys

Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default.