Software Design

API Key Generation and Scoped Permissions

Use Case Diagrams · made in Skemio

Use case diagram showing a Developer generating an API key, assigning scoped permissions and rate limits, hashing the token, and triggering instant revocation.
Use case diagram showing a Developer generating an API key, assigning scoped permissions and rate limits, hashing the token, and triggering instant revocation.
Open it in SkemioMake your own

What it shows

  • Hash keys using SHA-256 upon generation; display the secret token only once
  • Attach fine-grained scope prefixes to inspect capabilities without DB lookups
  • Enforce rate limits directly on key prefixes at your API Gateway edge

The takeaway

Treat API keys like passwords: hash them at rest, scope their privileges, and support instant revocation.

More use case diagrams