I'm securing API calls to a REST service I'm building using API Keys. The plan is to:
- When we get a new client, generate an API Key (a UUID).
- Email the API key to them.
- They send the API key on every call to our service (over HTTPS). We will lookup the API Key in our database (either encrypting or hashing it first) and figure out the account the API key is for.
Eventually, we'll add user accounts and a portal for all this so clients can generate and deactivate API keys without us needing to be involved.
My question is on the last part. Should I hash or encrypt (or leave unecrypted?) the API keys before storing them in the database? I'm trying to understand the implications. I know that if I hash them, then I'm protecting against someone knowing all API keys if they get DB access. But what are the other things I should be thinking about? For example, are there performance reasons to do one over the other?