API Design · Middle · Question 69 of 75
How should an API provider store the API keys it issues?
- 1Store them in the client's cookies
- 2Store keys in plain text so they can be shown again
- ✓Correct answer: Store only a hash of each key (like a password), show the full key once at creation, and use a visible prefix to identify it
Explanation
Prefixes like sk_live_ make leaked keys easy to detect by secret scanners and help users know which key is which.