Question 1

How long should an API key be?

Accepted Answer

At least 128 bits of entropy for production use. That's ~22 alphanumeric chars (log2(62)*22 ≈ 131 bits), ~32 hex chars (128 bits exactly), or ~22 base64url chars. The default of 40 alphanumeric chars (~238 bits) is generously safe and matches the format most major API providers use. Stripe (sk_live_...51 chars), GitHub (ghp_36 chars), OpenAI (sk-48 chars), and AWS access keys (20 chars after prefix) all sit in the 30-50 char range.

Question 2

What's the prefix for?

Accepted Answer

Prefixes serve two purposes. First, they make keys self-identifying — `sk_` for secret keys, `pk_` for publishable/public keys, `ghp_` for GitHub personal access tokens. Anyone seeing the key in a log or commit can immediately tell what it is. Second, prefixes enable secret scanning — GitHub, GitLab, and security tools scan code repos for known prefixes to detect accidentally committed secrets and notify the provider, who can then revoke the key. If you publish your API, register your prefix with GitHub Secret Scanning Partner Program for free automated leak detection.

Question 3

Should I store the API key in plaintext or hash it?

Accepted Answer

Hash it. Store only a hash of the key in your database; show the plaintext to the user exactly once when generated, then never again. On API requests, hash the incoming key and compare against the stored hash. Use a fast hash like SHA-256 (not bcrypt/Argon2) — API keys have far more entropy than passwords, so the slow-hash protection isn't needed and would add latency to every API call. This way, a database breach doesn't expose the actual API keys. Major providers (Stripe, AWS, GitHub) all use this pattern.

Question 4

How is this different from a JWT secret?

Accepted Answer

An API key is a credential — a long random string the client presents to authenticate. A JWT secret is a key — used to sign JWT tokens that prove a claim (like 'this token was issued by us'). API keys are typically static and stored; JWT secrets sign short-lived tokens that the server re-validates per request. Different purposes, similar entropy requirements.

API Key Generator

Frequently Asked Questions