Best way to generate API Key?

Question

Use Case

I'm building an iPhone app with a simple signup and login.

When a user signs up/logs in, I want the Ruby (Sinatra) server to generate/fetch and return an access token for that user that the iPhone client can then send with every subsequent request using Basic Authentication over HTTPS.

I'm not yet implementing OAuth 2.0 so that third party apps can access the server. Right now, I'm just building a simple, internal API (for my own, first-party, iPhone app).

Example

Basically, I want to generate a secret API key like Stripe's: https://manage.stripe.com/account/apikeys

For example: sk_test_NMss5Xyp42TnLD9tW9vANWMr

What's the best way to do that, say in Ruby?

Answer 1

The Ruby stdlib provides an entire class of secure random data generators called SecureRandom. Whatever you want, you can probably find it there.

Stripe's keys are essentially URL-safe Base64. You can get something very similar like so:

require 'securerandom'

p "sk_test_" + SecureRandom.urlsafe_base64

(Stripe does strip out non-alphanumeric characters, but that's trivial to do with gsub if you don't want hyphens in your keys.)