How to design secure API keys: entropy, prefixes, and secret scanning explained

·1 views

A software engineering guide outlines best practices for API key design, emphasizing that security depends on the randomness of the key body, with at least 22 alphanumeric characters needed to achieve the recommended 128-bit entropy threshold. Distinctive prefixes — such as Stripe's sk_live_ or GitHub's ghp_ — serve three practical purposes: distinguishing environments, speeding up incident triage, and enabling automated secret scanning tools to detect and revoke leaked keys in public repositories. The guide explains why UUIDs, despite meeting entropy requirements, are a poor choice because their generic format makes them invisible to secret-scanning tools. On the storage side, developers are advised to hash keys server-side using SHA-256, display the plaintext only once at issuance, and store only a short display suffix for user identification. The guide also stresses the importance of tracking key usage and building a rotation workflow — issue new, allow a dual-acceptance window, then revoke the old key — before it is ever needed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Laravel Agencies Can Separate Infrastructure, APM, and Web Vitals Monitoring

Laravel agencies managing multiple client apps often conflate three distinct monitoring jobs: infrastructure and deployments, application performance monitoring (APM), and front-end Core Web Vitals. Tools like Laravel Forge and Vapor reliably track server health and deployment pipelines, while APM products cover server-side timing, database queries, and failed jobs. Neither category automatically measures browser-side metrics such as Largest Contentful Paint or Cumulative Layout Shift on specific client URLs. A shared Blade layout change, for instance, can silently degrade mobile PageSpeed scores across an entire client portfolio even when ops dashboards show all-green. Keeping these three jobs clearly separated in retainer agreements prevents teams from missing front-end regressions and ensures clients understand exactly what is and is not being monitored.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Stream AI Token Responses Into an Angular App Using Fetch API

Streaming AI responses improves perceived performance by displaying tokens as they are generated, rather than waiting for a full response before rendering. Developer tutorial published on DEV Community walks through building a streaming chat component in Angular without relying on any SDK. The guide explains why the browser's built-in EventSource API is unsuitable for most LLM endpoints, as it only supports GET requests and cannot send authorization headers or JSON bodies. Instead, the tutorial uses a standard fetch call with stream enabled, reading chunks from the response body via a ReadableStream. The resulting component handles thinking tokens, clean cancellation, and typed responses, and is compatible with any OpenAI-compatible API endpoint.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Hype Mirrors the PC Boom: A Developer's Case for Healthy Skepticism

A software engineer argues that the current artificial intelligence hype cycle closely mirrors the Wintel era of the 1980s and 1990s, when Intel and Microsoft locked businesses into costly, perpetual upgrade cycles. In today's version, Nvidia plays the role of Intel by dominating expensive GPU hardware, while OpenAI, Anthropic, and Google ship increasingly resource-heavy models that demand massive infrastructure. The developer contends that despite bold claims about approaching artificial general intelligence, real-world performance gains between successive model releases are narrowing into incremental refinements rather than paradigm shifts. Drawing on history from the steam engine to the personal computer, the author notes that every major technological transition has produced the same split between fervent believers and doomsday forecasters. The piece calls on engineers to apply rigorous skepticism and evaluate AI tools by their practical utility rather than benchmark scores or marketing narratives.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Only 36% of To-Do Tasks Get Done, and Most Are Finished Within a Day

An analysis of 21,655 one-off tasks logged by 1,375 users on the habit-tracking app Loggd found that just 35.9% of tasks were completed. The study, conducted in August 2026 by the app's developer, excluded auto-generated recurring tasks to focus only on items people deliberately wrote down. Of completed tasks, 40.8% were finished on the same day they were created, and the median completion time was just one day. In contrast, overdue open tasks had a median age of 56 days past their planned date, with the top 10% sitting more than four months overdue. The data suggests that to-do lists function less as long-term storage and more as short-lived queues — tasks either get done quickly or are rarely done at all.

0 comments Read more at DEV Community