I am creating a public API that will require API key authentication. When a user wants to register a new API key, they send a request to one of our endpoints with a list of permissions they want. We generate a unique key (uuid4) and send it back to them encrypted by TLS.
I am planning to hash the key that was created and store it as the primary key of a database. On each user request we can rehash the key they send in the headers and index the database to check if it is indeed one of the keys we've created. We'll also have their list of permissions stored in a column which we can use to authorize them for certain routes.
Question: My concern is how we're going to associate an API key to a user. Say a user wants to see a list of API keys they've generated. Is it now impossible for us to produce this list? Also say that a user loses their API key. How would we identify which API key has been lost, so we can at least delete that record in the database? I'm wondering how this stuff is usually handled.