api key generator
How to generate a secure API key
An API key authenticates clients and services. Short, predictable, or git-leaked keys cause immediate damage. A good key is long, random, and lives outside source code.
Entropy and format
Aim for 32+ bytes of entropy. Hex is readable in logs. Base64URL fits headers and URLs. Alphanumeric avoids punctuation when systems reject it.
Generate in LedaTools
Pick length and format, generate with crypto.getRandomValues, copy once, and store it in a secrets manager (Vault, AWS SM, Doppler…). Generation is local.
Safe operations
Never commit keys. Scope per environment. Rotate after staff changes or incidents. Prefer short-lived tokens when your stack allows.
Common mistakes
Reusing the same key across prod and staging, logging full keys, or generating with Math.random. Always use a CSPRNG (Web Crypto).
API key vs JWT
API keys are often long-lived opaque secrets. JWTs carry claims and expiry. Choose based on whether you need rich identity or just a shared secret.
FAQ
Are keys secure?
Yes: generated with the browser Web Crypto API.
Do you store my keys?
No. They are not sent to a server.
What formats are available?
Hexadecimal, Base64URL, and alphanumeric.