What makes a good API key?

The first version of Glama API keys were just a random UUIDs, and the particular API key was: 05e3d22f-640b-4257-9325-8c2a8144639f.

However, I couldn't find any information about the API key in our database, and with this being just a random UUID, there wasn't much to go on.

After a few back and forths, it turned out that they were referencing an API key for a deleted account. However, this interaction made me want to rethink our API key format.

Base64URL is a variant of Base64 encoding that is URL-safe and filename-safe. It uses '-' and '_' instead of '+' and '/' respectively, and omits padding characters. This makes it ideal for use in URLs and filenames without requiring additional encoding.

The thing that I like about the Sentry's format is that the key itself encodes information that is useful for troubleshooting purposes.

The reason for Base64URL encoding the key is that it allows us to expand the information that is encoded in the key without changing the format of the key itself.

Leave a Comment