Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*"
Favorites infavorites:mine
Status closed:yes
Types is:question
Exclude -[tag]
For more details on advanced search visit our help page
Results tagged with Search options answers only user 47578

Application Programming Interface; a set of routines, protocols, tools or endpoints used in software development.

Since you will be generating an API key for each user, you could do exactly like you suggest- which is essentially treating each token like you would a password. You could store the id, the salt, and … hash it in the first place (unlike for a user generated password). But this depends on your threat model. If someone hacks your server, would you care if they had a list of everyone's API key? If yes, then hashing them is the way to go. …
answered Nov 24 '15 by TTT
First off, if we're talking about a website, the idea of having a public API which is used to create users seems strange to me. Usually an account is manually created by the person that wants one … , perhaps using a web page, and perhaps with a captcha. The ideas of API and captcha don't really go well together since APIs are called by Applications (thus the A in API), and captchas are designed to …
answered Mar 30 '16 by TTT
the api (per refresh token) at a time. This results in multiple users repeatedly invalidating each other's auth tokens by generating new ones. The api could detect the breach because refreshes are being made prior to the auth token expiration, and would know to immediately revoke the refresh token. …
answered Feb 10 '16 by TTT