Project API Keys
API keys page where users can manage their project's API keys.
ship.pluv.io comes with a prebuilt project API keys page. API secret keys are generated in a cryptographically secure way and are 1-way hashed into the database.
Important
This feature is only included for the following templates:
Cloudlare Monorepo
Tips
- API public and secret keys should be treated as if they were usernames and passwords respectively.
- Public keys should not be sensitive (i.e. is fine to be exposed on the client-side), and should only be used for things where you just need to identify which project an API request was made for (e.g. Stripe public keys identify which Stripe account the payment transactions are for).
- Private keys should be treated like passwords (i.e. should be 1-way hashed into your database). API requests that you charge users for should be protected by secret keys (i.e. not public keys) to prevent abuse scenarios.
- Since public keys are not sensitive, you can have them be base-64 encoded metadata that helps with debugging.