Backend · core
API Keys
Issuing, hashing, scoping, and rotating keys for machine clients.
Mental model
An API key identifies a machine caller. Store only a hash (like a password), show the secret once, attach scopes, and support rotation — because a leaked key is inevitable.
How to study API Keys
Begin by restating the mental model in your own words, then connect it to a concrete system you have built or operated. Name the mechanism, the constraint it addresses, and the trade-off it introduces. Use OWASP — API Security Top 10 (Broken Auth), Stripe — API key best practices to check details, but close the source before writing your explanation. Retrieval is the learning step; rereading is only preparation.
Next, compare API Keys with Auth Systems, Rate Limiting. Ask what changes in correctness, latency, resource use, operability, and failure recovery. Complete Hash and prefix API keys and preserve the command, input, output, and one failed attempt as evidence. Finish by explaining the idea without jargon to someone who has not studied the track.
Proof of understanding
- Explain the mechanism from first principles and identify the state it reads or changes.
- Give one situation where the concept is the right choice and one where it is not.
- Predict a realistic failure mode before running the drill, then compare the prediction with evidence.
- Connect the result to a roadmap or build artifact instead of treating the concept as isolated trivia.
Where it matters
Stripe, OpenAI, every developer platform.
Common mistakes
- Storing API keys in plaintext
- No prefix, so leaked keys are unsearchable in logs
- No rotation or revocation path
Learn from primary sources
Practice and explain it back
Hash and prefix API keys
Generate key sk_live_abc123, store SHA-256 hash only, show prefix sk_live for support lookup. Why never store plaintext?
Expected evidence: Leak of DB does not expose usable secrets.
Open the interactive drill →Review prompts
- How should API keys be stored, and why?
Build evidence
Reusable API key system
Issue, hash, scope, and rotate API keys for machine clients.
- Keys stored only as hashes
- Prefix for log-searchability
- Scopes and a revocation path