Redmine

From a security perspective, having a once generated, eternally valid, apikey is a no-go.

It would ge good, to have an administrative setable value to request apikey rotation within
a certain timeframe.

This would be just the same like forcing the users to use two-factor tokens.