# Best way to generate an API key?

**URL:** <https://www.ruby-forum.com/t/best-way-to-generate-an-api-key/147228>\
**Category:** Rails\
**Created:** [August 29, 2008, 4:49pm UTC](https://www.ruby-forum.com/t/best-way-to-generate-an-api-key/147228 "2008-08-29T16:49:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![marstoni](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e9bcb4/32.png) [@marstoni](https://www.ruby-forum.com/u/marstoni)\
**Post date:** [August 29, 2008, 4:49pm UTC](https://www.ruby-forum.com/t/best-way-to-generate-an-api-key/147228/1 "2008-08-29T16:49:45Z")

</div>

I’m in the middle of creating an API for our app and wanted to get  
some feedback on the best way to generate unique APIKEY’s for each  
account. Similar to Basecamp’s API keys for example.

md5 hash of username:password? base64 encoding? random string of  
characters?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![marstoni](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e9bcb4/32.png) [@marstoni](https://www.ruby-forum.com/u/marstoni)\
**Post date:** [August 30, 2008, 4:25am UTC](https://www.ruby-forum.com/t/best-way-to-generate-an-api-key/147228/2 "2008-08-30T04:25:22Z")

</div>

I would use a completely random hex code. I would seriously avoid  
hashing  
the username & password, that leaves all your users vunerable to a  
dictionary attack.

---

<div class="post-metadata">

**Author:** ![marstoni](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e9bcb4/32.png) [@marstoni](https://www.ruby-forum.com/u/marstoni)\
**Post date:** [August 30, 2008, 10:12am UTC](https://www.ruby-forum.com/t/best-way-to-generate-an-api-key/147228/3 "2008-08-30T10:12:38Z")

</div>

Thanks Joe,

Yeah from what I’ve seen so far many people use a SHA1 hex code based  
on Time.now plus some other random numbers.

---

<div class="post-metadata">

**Author:** ![marstoni](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e9bcb4/32.png) [@marstoni](https://www.ruby-forum.com/u/marstoni)\
**Post date:** [August 30, 2008, 1:56pm UTC](https://www.ruby-forum.com/t/best-way-to-generate-an-api-key/147228/4 "2008-08-30T13:56:43Z")

</div>

On Aug 30, 9:11 am, “Marston A.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Thanks Joe,
> 
> Yeah from what I’ve seen so far many people use a SHA1 hex code based  
> on Time.now plus some other random numbers.

You could have a look at the code rails uses for generating the  
secrets used for forgery protection (rake secret)

Fred

---

<div class="post-metadata">

**Author:** ![marstoni](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e9bcb4/32.png) [@marstoni](https://www.ruby-forum.com/u/marstoni)\
**Post date:** [August 31, 2008, 8:01pm UTC](https://www.ruby-forum.com/t/best-way-to-generate-an-api-key/147228/5 "2008-08-31T20:01:31Z")

</div>

You could use UUIDs.

[http://blog.labnotes.org/2005/10/18/ruby-uuid-generator/](http://blog.labnotes.org/2005/10/18/ruby-uuid-generator/)

> **[Universally unique identifier](https://en.wikipedia.org/wiki/UUID)**
>
> A Universally Unique IDentifier (UUID) is a 128-bit label used for information in computer systems. The term Globally Unique IDentifier (GUID) is also used, mostly in Microsoft systems.
> When generated according to the standard methods, UUIDs are, for practical purposes, unique. Their uniqueness does not depend on a central registration authority or coordination between the parties generating them, unlike most other numbering schemes. While the probability that a UUID will be duplicated is not ...