I wish I had read this when I rolled by first API key management system.

Some other useful points to note:

- in general, you’d probably want to version your API keys (something that wasn’t done in the example)

- I tend to think base58 is less important for something that you expect your users to copy and paste (eg API keys) rather than enter manually (eg OTP)

- In a previous product, we have used a high entropy string in lieu of having a username and password to access authenticated resources. It’s somewhat risky in theory but in the years it’s been around, it actually works surprisingly well in practice.