Two-tier API key authentication.
Keys are either secret (server-side) or publishable (client-side).
Only the hash is stored; the raw key is returned once at creation time.
The key_prefix (ga_sk_ or ga_pk_) allows identifying key type
without a database lookup.
Summary
Functions
Returns an Ecto changeset for creating or updating an API key. Validates the key type, ensures the prefix matches the type, and enforces hash uniqueness on non-revoked keys.
Generates a new API key string and its hash.
Hashes a raw API key for lookup using HMAC-SHA256.
Verifies a raw API key against a stored hash using timing-safe comparison.
Functions
Returns an Ecto changeset for creating or updating an API key. Validates the key type, ensures the prefix matches the type, and enforces hash uniqueness on non-revoked keys.
Generates a new API key string and its hash.
Returns {raw_key, hash}. The raw key should be shown to the user
once and never stored.
Hashes a raw API key for lookup using HMAC-SHA256.
Verifies a raw API key against a stored hash using timing-safe comparison.