It's a basic question, but I see in a lot of tutorials of authentication in restful webservices that some user goes to a website and register yourself with an ID and a password, after this registration the server sends a token, so that user can use in your application sending this token in every API request (in the header for example).
It makes me think about the security to store a token in database as the same of the client requests.
Is it better to store this token hashed or something?
Since you will be generating an API key for each user, you could do exactly like you suggest- which is essentially treating each token like you would a password. You could store the id, the salt, and the hash of the token in your database. Hashing is great as long as you never need to get the original key back.
Note that since this is something your system is generating, it isn't as important to hash it in the first place (unlike for a user generated password). But this depends on your threat model. If someone hacks your server, would you care if they had a list of everyone's API key? If yes, then hashing them is the way to go.
