My adventure in designing API keys
by vjay15 on 4/12/2026, 1:17:45 PM
https://vjay15.github.io/blog/apikeys/
Comments
by: bob1029
I don't understand the need for this level of engineering. It appears we are going for an opaque bearer token here. The checksum is pointless because an entire 512 bit token still fits in an x86 cache line. Comparing the whole sequence won't show up in any profiler session you will ever care about.<p>If you want aspects of the token to be inspectable by intermediaries, then you want json web tokens or a similar technology. You do not want to conflate these ideas. JWTs would solve the stated database concern. All you need to store in a JWT scheme are the private/public keys. Explicit tracking of the session is not required.
4/15/2026, 7:26:34 AM
by: weitendorf
Hey OP, sorry for the negativity, I think most of these commenters right now are pretty off-base. My company is building a lot of API infrastructure and I thought this was a great write up!
4/15/2026, 7:49:32 AM
by: randomint64
While it's true that API keys are basically prefix + base32Encode(ID + secret), you will want a few more things to make secure API keys: at least versioning and hashing metadata to avoid confused deputy attacks.<p>Here is a detailed write-up on how to implement production API keys: <a href="https://kerkour.com/api-keys" rel="nofollow">https://kerkour.com/api-keys</a>
4/15/2026, 8:03:37 AM
by: Savageman
Side note: the slug prefix is not primarily intended for the end-user / developer to figure out which kind of key it is, but for security scanners to detect when they are committed to code / leaked and invalidate them.
4/15/2026, 8:01:10 AM
by: calrain
I don't like giving away any information what-so-ever in an API key, and would lean towards a UUIDv7 string, just trying to avoid collisions.<p>Even the random hex with checksum component seems overkill to me, either the API key is correct or it isn't.
4/15/2026, 6:38:51 AM
by: ramchip
The purpose of the checksum is to help secret scanners avoid false positives, not to optimize the (extremely rare) case where an API key has a typo
4/15/2026, 7:44:36 AM
by:
4/15/2026, 7:04:38 AM
by: vjay15
Hello everyone this is my third blog, I am still a junior learning stuff ^_^
4/12/2026, 1:17:46 PM
by: dhruv3006
Hey - this was a great blog ! I liked how you used the birthday paradox here.<p>PS : I too am working on a APIs.Take a look here : <a href="https://voiden.md/" rel="nofollow">https://voiden.md/</a>
4/15/2026, 7:03:02 AM
by: usernametaken29
I know sometimes people just like to try things out, but for the love of god do not implement encryption related functionality yourself. Use JWT tokens and OpenSSL or another established library to sign them. This problem is solved. Not essentially solved, solved. Creating your own API key system has a high likelihood of fucking things up for good!
4/15/2026, 7:22:05 AM
by: MORPHOICES
[dead]
4/15/2026, 7:03:25 AM