When creating API tokens, one can pick any format one likes. Many people choose to use 40 random characters.
I'm wondering how much of a security issue is to prefix the API key with a prefix "leaking" it's use-case?
E.g. if I were to use 40char tokens I could do:
'myproj-refresh-'+random_chars(40). So that the resulting token will be
This allows me to
- detect the API key in other people's source code (and invalidate it)
- minimize the number of false-positives of such a token
What I'm worried about is that if it leaks, it's not just a random number, that can be anything, but rather a thing that has an obvious meaning. It's a refresh token for "my project".
Do you think it's a viable trade-off or should it be prevented?