Course outline

01 · HTTP & REST APIs

02 · Databases & Persistence

03 · Authentication & Authorization

04 · API Design & gRPC

05 · Caching, Queues & Background Jobs

06 · Production-Ready Services

07 · Advanced Auth & Tenant Security

08 · Performance & Caching at Scale

09 · Testing & Release Confidence

Stage 3 · Build

Advanced Auth & Tenant Security

API Key Management

Issue hashed API keys with prefixes, scopes, last-used timestamps, quotas, and rotation endpoints.

7 min readBuilding Backend ApplicationsBuild

Why API Keys

API keys authenticate third-party integrations, CLI tools, and service-to-service communication. Unlike user sessions, API keys are long-lived and do not expire with browser sessions. They need careful management.

Key Generation

Gogenerating-secure-api-keys.go

20 linesLn 1, Col 1Go

Never store API keys in plaintext. Store only the SHA-256 hash. The prefix helps identify the key type (live/test) and service. The plain key is shown once to the user.

Key Storage

API keys table


CREATE TABLE api_keys (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    user_id UUID NOT NULL REFERENCES users(id),
    name VARCHAR(255) NOT NULL,
    prefix VARCHAR(20) NOT NULL,
    key_hash VARCHAR(64) NOT NULL UNIQUE,
    scopes TEXT[] NOT NULL DEFAULT '{}',
    quota_daily INT NOT NULL DEFAULT 1000,
    last_used_at TIMESTAMPTZ,
    expires_at TIMESTAMPTZ,
    revoked_at TIMESTAMPTZ,
    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
);

CREATE INDEX idx_api_keys_hash ON api_keys(key_hash);

Store the key hash, not the key itself. The hash is used for lookup on every request. The prefix is stored for display purposes. Include scopes and quotas for access control.

Scopes and Quotas

Goapi-key-middleware-with-scopes.go

43 linesLn 1, Col 1Go

Validate the key, check scopes against the requested endpoint, verify the daily quota, and track usage. Return appropriate errors for each failure case.

Key Rotation

Gokey-rotation-endpoint.go

30 linesLn 1, Col 1Go

Rotate by revoking the old key and creating a new one with the same settings. Return the new key plain text once. After that, only the hash is stored.

Usage Tracking

Godaily-quota-tracking.go

16 linesLn 1, Col 1Go

Track daily API key usage with Redis INCR. The key expires automatically after 24 hours. Compare the count against the daily quota limit.

Show the key once, then only the hash

When creating or rotating an API key, show the full key to the user once. After that, only show the prefix and last 4 characters. The full key cannot be recovered from the hash.

Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.