You know, what I'd like to see more than standardised API tokens to make scanning easier is actual addressing of the underlying problem.

For example, we had a pentest done on a website and the pentester got all excited because they found some AWS tokens.

Trouble is, they would be worthless to anyone external because we were making good use of AWS IAM to lock them down with ACLs, Roles etc.

So it was effectively a non-event.

What happened to the old concept of layered security ? Why should discovery or leakage of an API key automatically give the attacker all the keys to the castle ?

In my ideal world, all cloud and API service operators would have the equivalent to AWS IAM and preferably would enforce its usage (i.e. "here's your API key, but it won't work until you set some layered security")