I'm implementing a REST API and I've generated 128-bit random API keys which are used with HMAC-SHA1 for authorization. Should I hash the secret key on both the client and server before using it, maybe with SHA1 or bcrypt? This would avoid storing the secret key in plaintext. However I've been having trouble finding other people doing this which makes me suspicious of this idea.
- The data being transferred is not sensitive, only the API key is, since a particular user may be able to add data or start jobs.
- I'm mainly trying to prevent easy access to the API key, either by someone running the server or by someone listening in.
- This is a plugin for an existing system which may be installed on other systems by other people so SSL is not an option.