Algolia allows you to generate virtual/secured API keys from another parent API key but without a call to their servers.
A virtual key thus generated on the server side with a defined "scope" (like a pre-defined user filter), can be exposed on the JS client and guarantees that API calls made using that virtual key are restricted to the scope defined when the virtual key was generated. It's easy to create 1 virtual key for every user without making requests to Algolia and ensures that each key is unique to a user.
Here's the Python implementation. I see that they are essentially creating HMAC hash with the parent key and pre-defined query parameters (the scope), and then base64 encoding it again with the raw query parameter string.
What I don't understand
When an API call is made using this virtual key, how will Algolia be able to verify that the request is valid? Are they going to iterate all existing API keys, regenerate the same HMAC+base64 string and compare with the key sent?
Is there a better way to achieve this?