What a good API key looks like
An API key is a bearer secret: whoever holds it can call your API. It needs enough randomness that it cannot be guessed, and a format that is easy to handle in headers, URLs and config files. Base62, letters and digits only, is a popular choice because it never needs escaping.
A short prefix such as sk_live_ or myapp_ makes keys recognizable. It helps secret scanners on GitHub and elsewhere spot leaked keys, and lets your team tell test keys from production keys at a glance.
Storing API keys on the server
- Store only a hash of each key (SHA-256 is fine for long random keys) and compare hashes on each request, so a database leak does not expose working keys.
- Show the full key to the user once, then only the prefix and the last four characters.
- Let users create several keys and revoke them one at a time, so rotation never causes downtime.
Frequently asked questions
How long should an API key be?
32 Base62 characters, about 190 bits, is plenty. Anything over 128 bits of entropy cannot be brute-forced.
Should API keys be hashed in the database?
Yes. Because the keys are long and random, a fast hash like SHA-256 is enough. Slow password hashes such as bcrypt are only needed for passwords people choose.