Generate a value

--- copy

Where does the randomness come from?

An API key is a long-lived secret, often committed to a client's config for months or years, so its resistance to guessing matters even more than a short-lived session token's.

This tool draws its key material from Galactropy's physical entropy pool and formats it as a URL- and header-safe string, ready to drop into an Authorization header or webhook signing secret.

⚠ Cryptographic notice

Never embed a generated API key directly in client-side JavaScript or a public repository; store it server-side and rotate it periodically, same as you would any other long-lived credential.

Frequently asked questions (FAQ)

Should I add a prefix to identify the key type?

It's a common and useful convention (e.g. `sk_live_...`) for making leaked-key scanning and internal key management easier. Prepend one after generating the random portion here.

How often should I rotate API keys?

There's no universal answer, but a common practice is every 90-180 days for keys with broad access, sooner if a key may have been exposed.