The `prefixed-api-key` package, currently at version 1.1.1, provides a robust solution for generating 'Seam-style' API keys in JavaScript and TypeScript environments. These keys incorporate a user-defined prefix, a short token for identification and blocklisting, and a long token that is never stored directly, only its hash. This design enhances security by reducing the server's attack surface and enables features like GitHub secret scanning due to the predictable prefix format. The library leverages standard cryptographic practices, including Base58 encoding (RFC-compliant) for the token components, offering advantages such as shorter keys compared to hex/base32, double-click selection, and high entropy comparable to UUIDv4. It ships with TypeScript types and is suitable for both Node.js and browser environments, focusing on a secure and developer-friendly approach to API key management.
npm install prefixed-api-keyVerified import paths — ran on the pinned version, not inferred.
Demonstrates how to generate a new Seam-style API key, highlighting which components to store securely and which to provide to the end-user, along with an example of safe storage.
Ensure your API key generation and storage logic explicitly saves `key.shortToken` and `key.longTokenHash`, and discards `key.longToken` after initial hashing and presentation to the user.
Prefix calls to `generateAPIKey` with `await` within an `async` function, e.g., `const key = await generateAPIKey({ keyPrefix: 'your-app' });`Use `await checkAPIKey(fullKeyFromClient, storedLongTokenHash);` for all API key validation logic.
For ESM, use `import { generateAPIKey } from 'prefixed-api-key';`. For CommonJS (if supported, though ESM is preferred), ensure the import path is correct and the `require` syntax is aligned with the package's export strategy (e.g., `const { generateAPIKey } = require('prefixed-api-key');` if it provides a CJS export, which might not be the case for modern ESM-first packages). Also, ensure `await` is used if calling in an `async` function.Verify that the API key string passed to these utility functions strictly adheres to the 'prefix_shorttoken_longtoken' format generated by `prefixed-api-key`. Inspect the input string for typos, missing delimiters, or incorrect components.
No dependency data recorded yet.