api-key-lifecycle-pattern

Securely storing and verifying API keys requires saving only salted SHA256 hashes in the database, never raw keys. You perform fast lookups using an indexed key_prefix, then validate the full key by comparing its salted hash against the stored value.

API key revocation is best handled by setting a revoked boolean flag to true on the key record. This idempotent revoke semantic disables authentication immediately while preserving the database rows for audit trails and operational history.

Implement API key issuance by generating a formatted key and returning the raw key to the client exactly once at creation time. The system then stores only a salted hash and a short indexed key_prefix for all future verification operations.

Prefix-based database lookup for API key authentication works by indexing the first 8 hex characters of the key. The authentication middleware queries the database using this indexed key_prefix to avoid full table scans before applying salted hashing to verify the match.

Yes, you can use this API key lifecycle pattern with FastAPI authentication middleware. It explicitly applies to REST or FastAPI-style gateways, utilizing prefix-based database lookups and salted hashing to verify requests efficiently.

You need an admin CLI to manage API key rotation and quotas operationally. The pattern defines a standard command set including issue-key, list-keys, revoke-key, and set-quota, ensuring secure operational tooling compatibility without exposing raw keys.