API Key Generator

// Node.js Express API with API key authentication

const express = require('express');
const app = express();

// Store API keys (in production, use database or Redis)
const validApiKeys = new Set([
  'sk_live_51Hx9Z9K3qR8M4nT7W2Y6P1A',
  'sk_test_78J3k9L2m1N5p8Q7R4T6W9Y0Z'
]);

// API key middleware
const apiKeyAuth = (req, res, next) => {
  const apiKey = req.headers['x-api-key'] || 
                 req.query.api_key;
  
  if (!apiKey) {
    return res.status(401).json({
      error: 'API key required'
    });
  }
  
  if (!validApiKeys.has(apiKey)) {
    return res.status(403).json({
      error: 'Invalid API key'
    });
  }
  
  // Add key info to request
  req.apiKey = apiKey;
  next();
};

// Protected route
app.get('/api/data', apiKeyAuth, (req, res) => {
  res.json({
    message: 'Access granted',
    key: req.apiKey.substring(0, 10) + '...'
  });
});

// Rate limiting (using express-rate-limit)
const rateLimit = require('express-rate-limit');
const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // 100 requests per window
  message: 'Too many requests'
});

app.use('/api/', apiLimiter);

# API Documentation Example

## Authentication
All API requests require an API key.

### Header Method (Recommended)
```http
GET /api/data HTTP/1.1
Host: api.example.com
X-API-Key: sk_live_51Hx9Z9K3qR8M4nT7W2Y6P1A
```

### Query Parameter Method
```http
GET /api/data?api_key=sk_live_51Hx9Z9K3qR8M4nT7W2Y6P1A
```

## Rate Limiting
- 100 requests per 15 minutes per key
- Rate limit headers included in responses

## Key Management
- Rotate keys every 90 days
- Different keys for different environments
- Monitor usage in dashboard
- Revoke compromised keys immediately

## Error Responses
```json
{
  "error": "Invalid API key",
  "code": 403,
  "message": "The provided API key is invalid"
}
```

## Best Practices
1. Never commit API keys to version control
2. Use environment variables
3. Implement HTTPS only
4. Monitor for suspicious activity
5. Have a key revocation process