It's a basic question, but I see in a lot of tutorials of authentication in restful webservices that some user goes to a website and register yourself with an ID and a password, after this registration the server sends a token, so that user can use in your application sending this token in every API request (in the header for example).

It makes me think about the security to store a token in database as the same of the client requests.

Is it better to store this token hashed or something?

1 Answer 1


Since you will be generating an API key for each user, you could do exactly like you suggest- which is essentially treating each token like you would a password. You could store the id, the salt, and the hash of the token in your database. Hashing is great as long as you never need to get the original key back.

Note that since this is something your system is generating, it isn't as important to hash it in the first place (unlike for a user generated password). But this depends on your threat model. If someone hacks your server, would you care if they had a list of everyone's API key? If yes, then hashing them is the way to go.

  • but the token will be associate within a user. I imagine that the token could be stored in a user table or something. And i dont need to know the token in plain text, just compare the hashes in every requisition, like a password.
    – gog
    Commented Nov 24, 2015 at 17:17
  • @ggui, I apologize- I completely misunderstood your question. I thought you were asking from the point of view of the user: "I have an API key which my application needs, where is the best place to store it?" I've updated my answer.
    – TTT
    Commented Nov 24, 2015 at 17:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .