BlogAPI design

Twenty characters is enough

New API keys have 20 characters after the prefix. Older keys keep working.

The old API keys had 32 hex characters after the prefix because that was what the UUID generator produced. That length wasn't a deliberate product choice.

I shortened newly created keys to 20 characters after the prefix. This shows the length of a secret key, with the actual characters replaced:

parse_xxxxxxxxxxxxxxxxxxxx

The body uses lowercase letters and digits, leaving out 0, 1, i, l, and o. That makes it easier to tell the characters apart when you're looking at a key on screen. Public keys keep their parse_public_ prefix and use the same length for the body.

Your existing keys still work. Both lengths are accepted, with the same X-API-Key or Authorization: Bearer header, so there's no need to replace a working key just to get a shorter one.

The next key you create in Keys uses the shorter format.