Hacker News Reader

Comment by tough | Hacker News Reader

Is this really expensive? We're a small startup providing API keys, to our customers.

It's totally free - there are details of how to join the program at https://docs.github.com/en/developers/overview/secret-scanni...

Hm - this would work better if keys were easy to scan with regular expressions.

Next time I implement api keys I wonder if it’s worth going out of my way to make them easy to identify. Eg, by prefixing every key with a few well known characters. Like FMLA_xxxxx for a fastmail app key.

That's exactly what GitHub did with their own keys and their new keys fit this format.

https://github.blog/2021-04-05-behind-githubs-new-authentica...

I just implemented our API with a PREFIX_KEY so our self-hosted customers can change it they want to.

We will be applying thanks for sharing greystell

If you go make an API key in Fastmail (Settings -> Password & Security -> API tokens), you'll see that it's prefixed very similarly to that (e.g. `fmo1-`) for this very reason! (There are some other neat things about our API key format I'd be happy to tell you about sometime if you're interested.)

Hah I just used that as the first example which came to mind.

Yeah absolutely - I'd love to hear about it!

Some services also use prefixes to provide additional context like account type and token validity length. I think Slack does this (service accounts have different prefixes than user accounts and I think temporary tokens have another prefix)

It's absolutely worth it, for everyone's sanity involved.

I would imagine the main expense for you will be your implementation cost:

https://docs.github.com/en/developers/overview/secret-scanni...

Your dev team would probably be able to give that a glance and estimate the work.

Reply on news.ycombinator.com