API Key Generator

API keys sit between passwords and operational identifiers. They are usually bearer credentials, so possession of a valid value is enough to make requests until the receiving service rejects, expires, or revokes it. A useful format therefore has to do two jobs at once: carry enough unpredictable secret material to resist guessing, and expose enough non-secret structure for humans and systems to identify the credential without asking for the full value again.

Public structure is helpful only when everyone treats it as public. A service prefix can identify the product, an environment segment can separate live and test credentials, and a public lookup ID can help the server find the verifier record quickly. None of those pieces should authorize a request by itself. The random secret segment is the part that carries guessing resistance.

Encoding changes how random bytes are printed, not how much entropy they carry. Base64URL is compact for headers and JSON, hexadecimal is easy to inspect, and Crockford Base32 avoids ambiguous characters, but a 32-byte secret still carries 256 bits before it is encoded. Shorter secrets may fit legacy fields, yet they leave less margin against guessing and accidental reuse.

• Copy the full key only into the intended vault, deployment secret, or client handoff path.
• Store verifier material and metadata on the server, not the full presented key in ordinary application tables.
• Rotate keys that appear in chat, tickets, source control, screenshots, logs, or shared exports.
• Pair every issued key with scope, rate limits, monitoring, and a revocation path.

API keys do not carry all the context a session or user account might have. The service receiving the key still has to verify the submitted full value, apply the current policy for that record, and reject old or overbroad credentials when the rollout changes.

How to Use This Tool:

Generate one rollout batch at a time so the key ledger, storage review, and JSON all describe the same credentials and handling policy.

1. Enter a short Service prefix, then choose Environment. Use Custom only when the destination system needs a label that is not already listed.
2. Choose Key shape. Prefix + public id + secret is the usual choice when your server can index by public ID before checking the submitted full key.
3. Pick Secret encoding and Secret bytes. The summary should show the bit target you expect, such as 256 bit secrets for 32 bytes.
4. Set Key count for the current issuance, migration, or fixture batch. Open Advanced only if you need a different Public id bytes value or separator character.
5. Leave Check segment included unless the receiving format cannot accept it. The setting is not used for Secret only output because there are no public segments to guard.
6. Select Regenerate keys. If generation is blocked, follow the status message before issuing any value. Common fixes are using a browser with cryptographic random generation, entering an alphanumeric custom environment, or keeping at least one public label for prefixed formats.
7. Review API Key Ledger and Storage Review before copying or downloading. Confirm Secret entropy, Random source, Server storage, and Handling against your rollout policy.

Interpreting Results:

Secret entropy is the main security value in the ledger. It is calculated from the selected secret byte count, not from prefix, environment, public ID, separator, or check segment. The default settings produce 256 bits per secret, while the smallest allowed setting produces 128 bits.

• API key is the value presented to the client or integration. Treat it as sensitive immediately.
• Public id can support database lookup, audit notes, and support references, but it should not prove access.
• Check helps catch copy and typing mistakes in prefixed formats. It does not replace server verification.
• SHA-256 storage hash is a verifier value derived from the full presented key. Store it with the metadata your service needs for lookup, revocation, and audit.
• Sensitive batch means the current output can leak live credentials through the clipboard, downloads, screenshots, browser history, or shared notes.

A high entropy number does not finish the security work. API keys still need narrow scope, rate limits, expiry or rotation, protected storage, monitoring, and a clear revocation path.

Technical Details:

API key strength comes from uniformly random bytes in the secret segment. Encoding only changes how those bytes are printed. A 32-byte secret carries 256 bits of entropy whether the characters are Base64URL, hexadecimal, or Crockford Base32. The display length changes because each alphabet carries a different number of bits per character.

Public labels improve operations without adding secret entropy. Prefixes, environment names, public lookup IDs, separators, and check values help humans and systems sort credentials, but the byte count of the random secret is what resists guessing. When comparing two key formats, compare the same secret byte count before considering visible length.

Formula Core:

The entropy calculation is direct byte math. The duplicate estimate below describes accidental duplicate secrets inside one generated batch. It is not the probability that an attacker guesses a valid key.

Here, B is Secret bytes, H is Secret entropy in bits, n is Key count, and P is the approximate duplicate-secret probability for that batch. With 32 secret bytes and 5 keys, H = 256 and the duplicate estimate is below 1e-30.

Transformation Core:

The three key shapes change which public segments are present. Prefix + public id + secret includes prefix, environment, public ID, secret, and optional check segment. Prefix + secret removes the public lookup ID while keeping public labels. Secret only removes prefix, environment, public ID, and check segment, leaving only the encoded secret.

Responsible Use Note:

Generate production keys only from a trusted device and browser session. The batch is prepared in the browser, but copied text, downloaded CSV, DOCX, JSON, screenshots, browser sync, and shared tickets can still expose live secrets. If your platform requires keyed hashing, a secret manager, or a different verifier format, follow that policy and use the generated hash as a reference rather than the only storage design.

Worked Examples:

For a production-style batch, use prefix st, environment Live, Prefix + public id + secret, Base64URL, 32 secret bytes, 5 keys, and an included check segment. Each ledger row follows the pattern st_live_, then a public ID, a 43-character secret, and a four-character check segment. Secret entropy shows 256 bits, and SHA-256 storage hash gives a verifier value for each full key.

A legacy system may accept only a plain token. Choose Secret only, Hexadecimal, 16 secret bytes, and 1 key. The API key becomes a 32-character hexadecimal secret, Public id shows -, Check shows off, and Secret entropy shows 128 bits. Keep the receiving service scoped, rate-limited, monitored, and ready for rotation.

If Environment is Custom and the custom value contains only punctuation, generation is blocked because the normalized environment is empty. Enter a value such as sandbox, choose a built-in environment, or choose None, then regenerate the batch.

FAQ:

Glossary:

Bearer credential

A credential where possession of the value is usually enough to authenticate a request.

Secret entropy

The number of unpredictable bits in the random secret segment.

Public ID

A non-secret lookup segment that helps the server find the matching verifier record.

Check segment

A short non-secret value that helps catch copy, paste, or typing mistakes.

Verifier hash

A stored digest used to check a submitted full key without keeping the full key in ordinary tables.

Rotation

Replacing an issued key with a new value and retiring the old one in the receiving service.

References:

• How to authenticate with an API key in cURL, Simplified Guide.
• How to authenticate with an API key in wget, Simplified Guide.
• NIST Special Publication 800-63B, National Institute of Standards and Technology.
• FIPS 180-4 Secure Hash Standard, National Institute of Standards and Technology.
• Crypto: getRandomValues() method, MDN Web Docs.
• Secrets Management Cheat Sheet, OWASP Cheat Sheet Series.