{
  "id": 4108572,
  "title": "Client API Key — Design (Lite) ออกแบบ API key service to service ให้เบาและยังถูกต้อง",
  "url": "https://urgent.news/2026/08/29/client-api-key-design-lite-api-key-service-to-service",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-29T04:48:17.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/m4r14/client-api-key-design-lite-10hg"
  },
  "original_language": "th",
  "account": "The design for a lightweight API key service aims to provide a simple and secure solution for service-to-service communication. The key focuses on six columns and ten lines of functions, making it easy for anyone to implement. The main goal is to ensure that only authorized services can access the API without revealing the key to end-users.\n\nThe lite design does not include scopes, cache, CLI, or unique constraints on the consumer column. This simplification aims to keep the implementation lightweight and efficient. The key hash is stored in an environment variable, while the key itself remains secret. The revoke process checks the timestamp in the query rather than the code, ensuring accurate and secure revocation.\n\nThe primary design decisions revolve around not storing the key directly, revoking keys using timestamps, and avoiding the inclusion of UNIQUE constraints on the consumer column. By not storing the key, unauthorized access is minimized. Timestamp-based revocation allows for efficient revocation checks in queries. Excluding UNIQUE constraints reduces complexity and enables key rotation when necessary.\n\nThe CREATE TABLE statement outlines the six columns: ID, consumer, key_hash, revoked_at, description, and created_at. The key_hash is stored as a SHA256 hexadecimal value, making authentication secure without requiring bcrypt. The revocation timestamp is stored to track when a key was revoked, providing transparency and accountability.\n\nTo revoke a key, update the last_used_at timestamp in the query. This ensures that revoked keys are easily identifiable and can be revoked promptly. The UNIQUE constraint on the consumer column is optional and can be added later if needed. Key rotation is recommended to maintain security, but it involves dropping and recreating the table. When a key is revoked, a new key must be deployed, and consumers must switch to the new key. This process ensures that revoked keys are no longer valid while maintaining minimal downtime.",
  "summary": "ออกแบบ API key สำหรับการเรียกกัน service to service ให้เบาและยังถูกต้อง วันหนึ่งจะมีอีกทีมมาขอเรียก service ของคุณ และคุณต้องรู้ให้ได้ว่าใครเป็นคนยิงเข้ามา ตัวเลือกที่คนส่วนใหญ่หยิบมีสองขั้ว — ยัดค่าสุ่ม uuid/hash ไว้ใน env var แล้วเทียบสตริง ซึ่งใช้ได้จริงจนถึงวันที่ key หลุด หรือลาก OAuth2 มาทั้งชุด ซึ่งซับซ้อนกว่าสิ่งที่กำลังจะปกป้องหลายเท่า โพสต์นี้คือทางกลาง TL;DR ตารางเดียว 6 คอลัมน์…",
  "key_points": [
    "Lightweight API key service designed for service-to-service communication",
    "Six columns and ten functions in the CREATE TABLE statement",
    "Keys revoked using timestamps, not stored directly in the database"
  ],
  "editors_take": "This design streamlines service-to-service communication by providing a lightweight, secure API key solution that minimizes unauthorized access and enables efficient key revocation and rotation.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}