api - Best practices and things to keep in mind when creating ApiKeys and Secret?

Question

I'm building an API server. It has auth and other micorservices that talk to it.

Now I want to create ApiKeys and Secrets.

I basically want to create something like this, https://mailchimp.com/help/about-api-keys/. Someone can login and generate an ApiKey and Secret that can be used to communicate with my API that I've made. This way people can make cool bots and what not. What are the best practices I need to know and what should I look out for/keep in mind when build this? Some things I have in mind already are:

1. Permissions/Roles for ApiKeys.
2. Deleting keys if user account is deleted (so obviously keep a reference of who's creating the Keys)
3. Obviously generate the key with some UUID.
4. Secure secrets in database with a hash/encryption.
5. Should ApiKeys be allowed to create more ApiKeys?
6. How will these be sent? Via headers?
7. List item

If you know of more things to keep in mind and "best practices" please tell!

question from:https://stackoverflow.com/questions/65921280/best-practices-and-things-to-keep-in-mind-when-creating-apikeys-and-secret

Answer 1

Waitting for answers