api-keyslisted

# API Keys The API key is the first artifact of your product a developer ever holds. They see the key before they see a single response body. It is also the credential that ends up in their env files, CI secrets, and (inevitably) a leaked repo. The bar is Stripe's key design plus GitHub's leak-response machinery. Getting this right at design time costs a day; retrofitting a key format costs a migration across every customer. ## Before you start Check for `.agents/devtool-context.md` and read it if present (product name, API shape, and stack all feed the design). If absent, ask: 1. What does the API do, and is there data that's readable client-side (do you need publishable keys, or only secret ones)? 2. Is there a dashboard where keys will be created and revoked? 3. What's the stack, specifically the database and web framework? ## The design, in order of consequence Positions below are defaults. Deviate only with a reason. ### 1. Key format: prefixed, high-entropy, checksummed Every key carries a human-readable prefix identifying your product, the key type, and the mode: ``` sk_live_Xk29fjB1nQ7wLmZo4pT8Rd # secret key, live mode sk_test_... # secret key, test mode pk_live_... / pk_test_... # publishable key (only if you have client-side reads) ``` Write the format spec down as a registry in your repo and treat it as an API contract: ``` <prefix>_<mode>_<22 chars base62>[<6 chars base62 CRC32 checksum>] sk = secret key (s