core practice · coding problem
Hash and prefix API keys
Generate key sk_live_abc123, store SHA-256 hash only, show prefix sk_live for support lookup. Why never store plaintext?
The mechanism
An API key identifies a machine caller. Store only a hash (like a password), show the secret once, attach scopes, and support rotation — because a leaked key is inevitable.
Expected evidence
Leak of DB does not expose usable secrets.
Try this drill in the practice workspace →
Hints when you need them
- Prefix helps support find row.
- Rotate on compromise.
Watch for these mistakes
- Storing API keys in plaintext
- No prefix, so leaked keys are unsearchable in logs
- No rotation or revocation path