Generate one transient opaque API-key candidate with a bounded non-secret prefix, an explicit alphabet, unbiased Web Crypto sampling, and no key retention.
Choose your path
Generate one transient opaque API-key candidate from a bounded non-secret prefix, explicit random-part length and explicit alphabet, while leaving issuance, identity, scopes, storage, delivery, rotation, expiry, revocation and audit to the real service.
Separate a recognizable non-secret prefix from an opaque random secret part.
Choose the exact prefix/alphabet/length contract, generate a fixture and implement lookup/scope/lifecycle records on the issuer.
The format is reproducible without treating the key string as an authorization system.
Move one generated candidate directly to an approved secret manager and recipient.
Generate deliberately, copy once to the issuance workflow, confirm receipt and clear the page.
No key appears in Project data, tickets, notes, history, logs or source control.
Verify revocation, rotation, least privilege and monitoring outside random generation.
Save only format settings/warnings, then test server-side hashing, scope enforcement, expiry, revoke and audit paths.
A long random value is never accepted as complete API protection.
Outputs and checklists are planning aids. Review the linked current authorities and the records, terms, instructions, and requirements that apply to your exact situation before a consequential decision.
This tool is part of these guided projects. Each project provides step-by-step instructions with checklists and all the tools you need in one place.
Tools you might need next
Build reproducible fictional API fixtures with reserved example values, strict field names, a visible seed, and JSON, CSV, SQL or TypeScript output.
Generate mock JSON data. Custom fields. For frontend and API testing. Free developer utility that runs locally in your browser — fast, private, and no server
Generate one transient random password with unbiased Web Crypto sampling, explicit target-service character settings, and no password history or Project retention.
The random part is 16–128 characters. The optional prefix is limited to 32 visible identifier characters and excludes control characters so it remains a non-secret classification aid.
Web Crypto supplies random bytes and rejection sampling maps them to the exact hexadecimal, alphanumeric, or Base64URL alphabet without modulo bias.
The Tool creates only a candidate value. It does not assign scopes, bind an owner, store a verifier, deliver a secret, set expiry, rotate, revoke, audit, or validate authorization.
Updated: August 2026
A platform engineer chooses a non-secret environment/product prefix and Base64URL random part, then implements separate server-side identity, scope, storage, and revocation records.
An operator generates once, copies directly to the approved vault or issuance system, confirms receipt, and clears the page without placing the key in chat or tickets.
A reviewer saves format settings and the lifecycle warning to the Project while testing hash-at-rest, scopes, expiry, rotation, revocation, auditing, and incident response separately.
Create one opaque candidate only after confirming prefix, random-part length, and alphabet. The value stays in transient page state and is deliberately excluded from Project Data; server-side hashing, scopes, rotation, expiry, revocation, and auditing remain separate work.