Easy, secure API keys

Sun, 27 Aug 2023 02:06:05 +0000

I needed to add API key authentication to our work environment. I needed:

To develop the functionality quickly
Be confident in the security of the system
- API keys should only be visible once when created
- Should be hard to impersonate other users/be resilient to DB leak
Have an upgrade path for when we want to change/improve things
Performance isn’t a huge consideration

I was able to use JWT tokens in a slightly clever way to make this happen. The best part is, there are no stored secrets on the server side. All of the server data could be revealed publicly without compromising the security. Here’s how:

Security on sugar, spice, &terminal? nice

Easy, secure API keys