In Azure Cosmos DB, a primary key is an account-level secret used to authenticate requests to the service. Unlike a narrow application token, it is highly privileged: if someone has the key, they may be able to perform full read and write operations across the databases and containers exposed by that Cosmos DB account.
This matters because a leaked primary key can turn a small security mistake, such as source code exposure or secret reuse, into broad data compromise. Attackers do not need to bypass the platform if they can simply authenticate as the account. Defenders reduce this risk by rotating keys quickly, storing secrets in Azure Key Vault, and preferring managed identity, Microsoft Entra ID, and role-based access control to avoid long-lived shared credentials.