API Keys — Complete Implementation Guide for Service Auth

import secrets
import hashlib
import hmac
from datetime import datetime, timedelta

class APIKeyManager:
    def __init__(self):
        self.stored_keys = {}

    def generate_key(self, client_name, tier="standard"):
        prefix = "sk_live" if tier != "test" else "sk_test"
        random_part = secrets.token_urlsafe(32)
        api_key = f"{prefix}_{random_part}"

        key_hash = hashlib.sha256(api_key.encode()).hexdigest()
        key_id = secrets.token_hex(8)

        self.stored_keys[key_hash] = {
            "key_id": key_id,
            "client_name": client_name,
            "tier": tier,
            "created_at": datetime.utcnow(),
            "expires_at": datetime.utcnow() + timedelta(days=365),
            "is_active": True,
        }

        print(f"[APIKey] Key generated for {client_name}")
        print(f"[APIKey] Key ID: {key_id}")
        print(f"[APIKey] IMPORTANT: Store this key securely - it won't be shown again:")
        print(f"  {api_key[:12]}...{api_key[-4:]}")
        return {"api_key": api_key, "key_id": key_id, "tier": tier}

    def validate_key(self, api_key):
        key_hash = hashlib.sha256(api_key.encode()).hexdigest()
        key_data = self.stored_keys.get(key_hash)

        if not key_data:
            print(f"[APIKey] Invalid key rejected")
            return None

        if not key_data["is_active"]:
            print(f"[APIKey] Deactivated key rejected")
            return None

        if datetime.utcnow() > key_data["expires_at"]:
            print(f"[APIKey] Expired key rejected")
            return None

        print(f"[APIKey] Key validated: {key_data['client_name']} ({key_data['tier']})")
        return key_data

    def revoke_key(self, key_id):
        for key_hash, data in self.stored_keys.items():
            if data["key_id"] == key_id:
                data["is_active"] = False
                print(f"[APIKey] Key {key_id} revoked")
                return True
        return False

    def rotate_key(self, old_api_key, client_name):
        old_data = self.validate_key(old_api_key)
        if not old_data:
            return None
        self.revoke_key(old_data["key_id"])
        return self.generate_key(client_name, old_data["tier"])

manager = APIKeyManager()
result = manager.generate_key("Acme Corp", "premium")
print(f"\nKey preview: {result['api_key'][:12]}...")
validation = manager.validate_key(result["api_key"])
print(f"Validated: {validation['client_name'] if validation else 'FAILED'}")

const crypto = require("crypto");

class APIKeyAuthenticator {
  constructor() {
    this.keys = new Map();
  }

  addKey(apiKey, client) {
    const hash = crypto.createHash("sha256").update(apiKey).digest("hex");
    this.keys.set(hash, {
      clientId: client.id,
      clientName: client.name,
      tier: client.tier || "standard",
      rateLimit: client.rateLimit || 100,
    });
  }

  authenticate(req, res, next) {
    const apiKey = req.headers["x-api-key"] || req.query.api_key;
    if (!apiKey) {
      return res.status(401).json({ error: "API key required" });
    }

    const hash = crypto.createHash("sha256").update(apiKey).digest("hex");
    const keyData = this.keys.get(hash);

    if (!keyData) {
      console.log(`[Auth] Invalid API key from ${req.ip}`);
      return res.status(403).json({ error: "Invalid API key" });
    }

    req.client = keyData;
    console.log(`[Auth] Authenticated: ${keyData.clientName} (${keyData.tier})`);
    next();
  }
}

const auth = new APIKeyAuthenticator();
auth.addKey("sk_live_test_key_123", {
  id: "client_1",
  name: "Acme Corp",
  tier: "premium",
  rateLimit: 10000,
});

module.exports = auth;

import json
import secrets
import hashlib
from datetime import datetime, timedelta

class APIDashboard:
    def __init__(self, storage_path="api_keys.json"):
        self.path = storage_path
        self.load()

    def load(self):
        try:
            with open(self.path) as f:
                self.data = json.load(f)
        except FileNotFoundError:
            self.data = {"clients": {}, "keys": {}}

    def save(self):
        with open(self.path, "w") as f:
            json.dump(self.data, f, indent=2, default=str)

    def list_keys(self):
        print(f"{'Client':<20} {'Key ID':<12} {'Tier':<10} {'Status':<10} {'Expires':<15}")
        print("=" * 70)
        for hash_val, key_data in self.data["keys"].items():
            print(f"{key_data['client']:<20} {key_data['key_id']:<12} {key_data['tier']:<10} {'Active' if key_data['active'] else 'Revoked':<10} {key_data['expires']:<15}")

    def generate(self, client, tier="standard"):
        key = f"sk_live_{secrets.token_urlsafe(32)}"
        key_hash = hashlib.sha256(key.encode()).hexdigest()
        key_id = secrets.token_hex(6)
        self.data["keys"][key_hash] = {
            "key_id": key_id, "client": client, "tier": tier,
            "active": True, "created": str(datetime.utcnow()),
            "expires": str(datetime.utcnow() + timedelta(days=365)),
        }
        self.save()
        print(f"Generated key: {key[:12]}...{key[-4:]} (ID: {key_id})")
        print("Store this key securely - it will not be shown again")

    def revoke(self, key_id):
        for k, v in self.data["keys"].items():
            if v["key_id"] == key_id:
                v["active"] = False
                self.save()
                print(f"Key {key_id} revoked")
                return
        print("Key not found")