There was a similar question which I found which was asked the better half of a decade ago "Is it okay for API secret to be stored in plain text or decrypt-able?", but the majority of answers seem to revolve around API security schemes where the secret is used as a key, for example, to produce a hash, in which case the answer is of course that you need to have a full copy of it available.

However, there are other API schemes, if we take a look at Stripe, for example, you can see that essentially the secret is used as a password in a request header:


I have no particular insight into how Strip operates, but there is of course some level of a performance hit if you allow there to be multiple active API keys assuming you use any reasonable hashing scheme.

Now I can think of a way of avoiding this (such as including in the key some sort of identifier which can be used to pull back the specific hashed version), but that doesn't seem to have been done here.

So, is there some reason why you would not need to hash this data? It seems like it is just as important as any password, with perhaps the exception to the fact you know it's not being reused on other websites.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.