Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Making Beautiful API Keys

docs.agentstation.ai

Post reply on HN
Print view View original

11–20 of 107 posts

Re: Making Beautiful API Keys

#11

Post by jjice »

theamk wrote: post #2

One of the best things you can do to your API key is to give it a fixed prefix. Makes it very easy to tell that you have the right string, to detect accidental secret leakage, etc... IMHO this makes key much more beautiful than any internal structure.

I'm a big fan of prefixed keys as well. If I could go back in time, I would've made my current company's API keys prefixed. Sometimes you'll chat with a customer and just notice the same isn't right and realize the key is all wrong. It's a lot easier if it starts with `company_XXXXX`. Also denoting environment (live vs test in Stripe) with a prefix is actually critical in my eyes.

I also like prefixed resource IDs. Stripe is the first one that comes to mind, but I've run into it multiple times where a customer is describing an issue and it turns out the ID they're trying to lookup is for a different resource (often similar). You don't get those accumulated hours of support time back...

Re: Making Beautiful API Keys

#12

Post by copperlight »

notpushkin wrote: post #4
mtmail wrote: post #3

"encodes UUIDs to a readable Key format via the Base32-Crockford codec and also decodes them back to UUIDs." Example: "d1756360-5da0-40df-9926-a76abff5601d" => "38QARV0-1ET0G6Z-2CJD9VA-2ZZAR0X" I think now you risk having 0 vs O or I vs 1 readability issues. [edit: good news, I was wrong]

Base32-Crockford doesn’t have 0 and 1 for this exact reason! (Seems uuidkey authors have decided to remove O and I instead, but the effect is the same) EDIT: I’ve looked it up and I was wrong! Crockford alphabet does use all digits (0–9), but doesn’t have O, I or L. When decoding, O is mapped back to 0 and both I and L are mapped to 1. Sorry for the confusion!

https://www.crockford.com/base32.html

> We chose a symbol set of 10 digits and 22 letters. We exclude 4 of the 26 letters: I L O U.

I had never heard of Base32 Crockford before. The whole rationale is clever.

Re: Making Beautiful API Keys

#13

Post by zdc1 »

mtmail wrote: post #3

"encodes UUIDs to a readable Key format via the Base32-Crockford codec and also decodes them back to UUIDs." Example: "d1756360-5da0-40df-9926-a76abff5601d" => "38QARV0-1ET0G6Z-2CJD9VA-2ZZAR0X" I think now you risk having 0 vs O or I vs 1 readability issues. [edit: good news, I was wrong]

I feel like they really missed the mark with "Beautiful" as their priority. If I were to make a UUID to API key encoding/serde library I'd definitely prioritise things like human readable characters / phrases (e.g. BIP-39 style with hyphens), and as jjice said, a fixed prefix.

Edit: okay, good to know were at least covered for 1 vs I issues.

Re: Making Beautiful API Keys

#14

Post by dewey »

notpushkin wrote: post #8
theamk wrote: post #2

One of the best things you can do to your API key is to give it a fixed prefix. Makes it very easy to tell that you have the right string, to detect accidental secret leakage, etc... IMHO this makes key much more beautiful than any internal structure.

I’ve made a library for that! https://codeberg.org/prettyid

Why should anyone vendor a dependency in a critical functionality for three lines of code (https://codeberg.org/prettyid/js/src/branch/master/lib/index...)?

Re: Making Beautiful API Keys

#15

Post by lovasoa »

Dashes in API keys are really annoying. Double-clicking doesn’t select the full key, which just adds extra hassle. It would be much better if they used a continuous string without any separators. Makes copying and pasting way easier, and doesn't affect security at all.

Re: Making Beautiful API Keys

#17

Post by moebrowne »

theamk wrote: post #2

One of the best things you can do to your API key is to give it a fixed prefix. Makes it very easy to tell that you have the right string, to detect accidental secret leakage, etc... IMHO this makes key much more beautiful than any internal structure.

Agreed. I like what GitHub did with their API tokens, not only adding prefixes but also a checksum.

https://github.blog/engineering/platform-security/behind-git...

Re: Making Beautiful API Keys

#18

Post by tommica »

anticorporate wrote: post #6

I love the throwback reference to the Diablo II CD key. There are some CD keys that will be forever etched in my brain, no matter how many PINs I struggle to remember. I suspect a good number of you know far too much of a certain string that starts with FCKGW.

For those who don't know: https://scribe.rip/@cristian.nedelcu/fckgw-rhqq2-yxrkt-8tg6w...

Re: Making Beautiful API Keys

#19

Post by philo23 »

A bit off topic, but on the copying issue with dashes, you can wrap the whole key in a span styled with “user-select: all” to improve the copying experience. Well, on the web at least!

Re: Making Beautiful API Keys

#20

Post by HideousKojima »

dewey wrote: post #14
notpushkin wrote: post #8

Earlier quoted context omitted.

I’ve made a library for that! https://codeberg.org/prettyid

Why should anyone vendor a dependency in a critical functionality for three lines of code ( https://codeberg.org/prettyid/js/src/branch/master/lib/index... )?

That's the JavaScript/Node ecosystem in a nutshell. See the LeftPad fiasco and the mere existence of the IsOdd and IsEven packages for more poor judgement.
Post reply on HN