Twenty characters is enough
New API keys are parse_ plus 20 lowercase characters, short enough to read off a screen. Legacy 32-hex keys stay valid.
The old keys were 32 hex characters because a UUID generator was sitting there.
parse_xxxxxxxxxxxxxxxxxxxx
New keys are parse_ plus 20 lowercase characters. Public keys keep the loud prefix, parse_public_ plus the same 20. The letters that look like numbers are out, so a key you read off a screen is a key you can type. Legacy 32-hex keys stay valid. The edge accepts both.
Same header
X-API-Key and Authorization: Bearer still take whatever you minted. Rotate when a project changes. Do not rotate because the new ones are shorter.
Try it
Mint a key and count the characters after parse_. Twenty. You can read it out loud without saying "was that a one or an L."