PHP API Key Generator

Question

Does anyone know of any API key generator script/class for PHP? The class should have method generate, that would generate a key and isValid() method, to check if the key is valid.

Solution 1

There are multiple ways to generate API keys. I've used following 3 methods depending on the applications,

1. Base62(random). Generate a large secure random number and Base-62 encode it. The key looks like "w5vt2bjzf8ryp63t". This is good for self-provisioned system. You don't have to worry about collision and inappropriate keys. You have to check database to know if the key is valid.

2. Base62(MD5-HMAC(key, Normalize(referer))). This works great if the API is only allowed from one site. Just check the HMAC of the normalized referer and you know if the key is valid, no database access. You need to keep the HMAC key secret to do this.

3. Human assigned friendly names like "example.com". This works great if API users are required to own a domain or they are your corporate partners.

Please keep in mind that there is no security in API keys. It's just a name assigned to your API application. More and more people are using terms like "App ID" or "Dev ID" to reflect what it really is. You have to assign another secret key if you want secure your protocol, like consumer_key/consumer_secret in OAuth.

Solution 2

Here is my simple answer to this question:

$key = implode('-', str_split(substr(strtolower(md5(microtime().rand(1000, 9999))), 0, 30), 6));

Solution 3

just use something like this (pseudo code) sha1(salt + time + mac-addr + another salt + some other random data) crc32 or md5 would also work inestead of sha1 and store it in a database and then isValid() checks the db if the key exists?

Solution 4

You can just use md5(uniqid()) and divide it into parts or format in other preferable way.

Solution 5

Well as it has been mentioned, it is all dependant on the situation. One method that I needed to use was to authenticate a referer url with a specifically assigned API key. So with the API key all that was really needed was (pseudo) key = md5(referer url + name + salt) which you then can have a checksum for. I know it has been mentioned similar to this before, but it is just that way. As for the isValid() function, all you need to do with this is compare it against the checksum and URL.

Edit: Just realised the age of the original question :S

View more solutions

Comments

[xpepermint]

That was my first thought :).

[user3529201]

Dont forget that you can't just take the SHA1 (or any other hash) checksum and check if it's "valid", unless you provide all the other data as well...

[dusoft]

you can't find mac address of the target computer if not on your local network. don't forget!

[nilamo]

Why would you add multiple salts? That adds only in possibly confusing yourself, not in making anything more 'secure'.

[thr]

@nimalo: You're 100% correct, I think I ment to type "other random data" or something there to.

[Chris Harrison]

Curiosity: Why specifically base62? Why not base64 for example?

[TommyAutoMagically]

Base 62 restricts the resulting charset to (A-Za-z0-9). (26+26+10=62) This means you may be able to make certain convenient assumptions in your app about the makeup of keys. They also appear more consistent (since they are just alphanumeric) than Base64.

[Philzen]

guess it's this paragraph that turns people off: Warning: This function does not create random nor unpredictable strings. This function must not be used for security purposes. Otherwise: Nice to know it's there.

[Martin Thoma]

@Philzen: Probably. password_hash might be an interesting alternative.

[MrMedicine]

There is security in random keys when used in combination with SSL?

[Fulldump]

Please, do not do that. If two requests are processed in the same millisecond (quite probable), two users will get the same api key :S

[AHeraldOfTheNewAge]

It makes sense, that's a great feedback! I think a quick fix is concatenating that time() function with some random number so something like: md5(time().rand()) would do better