Generate API Key Password

An API key is a public identifier that tells a service which application is making the request, similar to a username. An API secret (or API token) is the private credential that authenticates the request, similar to a password. The key can be visible in URLs or logs, but the secret must be kept confidential and never exposed in client-side code.

Immediately revoke the exposed key in the service's dashboard and generate a new one. GitHub's secret scanning may alert you, but do not wait for it. Remove the key from your code and use git filter-branch or BFG Repo-Cleaner to purge it from history. Even after removal, assume the key was compromised since bots scan public repositories within seconds.

Alphanumeric API keys are strongly preferred. They are URL-safe, do not require encoding in HTTP headers, work reliably in environment variables across all operating systems, and avoid parsing issues in JSON, YAML, and shell scripts. A 32-character alphanumeric key provides about 190 bits of entropy, which is more than sufficient.

Support multiple active keys simultaneously. Generate the new key, deploy it to all consuming services, verify they are using the new key by monitoring logs, then deactivate the old key. Most cloud providers support having two active keys per service account specifically for this purpose. Automate this process in your CI/CD pipeline.