My adventure in designing API keys
Summary
An exploration of API keys, their formats and security implications, followed by a detailed comparison of approaches to map API keys to data stores in a multi-tenant, sharded backend. It covers default hash-based mapping, prefix-based approaches, and encoding methods, with benchmarks favoring SHAKE256-based encoding of 10 characters for performance and low collision risk.