---
name: "api-key-entropy-masking-guard"
description: "Generate high-entropy API keys and redact sensitive secrets from logging pipelines."
metadata:
  author: "Stripe"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "generate secure api keys"
  - "mask api key in logs"
  - "hash api keys in database"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# API Key High-Entropy Verification & Masking

Designs secure API key lifecycle management: generating 256-bit cryptographically secure keys with recognizable prefixes (sk_live_), storing salted hashes in database, and masking keys in server logs.

## When to Invoke
Invoke this skill whenever you need to:
- generate secure api keys
- mask api key in logs
- hash api keys in database

## Execution SOP & Rules
1. Generate keys using crypto.randomBytes(32).toString('base64url').
2. Prefix keys with descriptive identifiers (e.g. sk_live_ or pk_test_) for automated leak detection.
3. Store the SHA-256 hash in the database and index for fast O(1) lookup.
4. Redact API keys from application logs using regex masking filters before writing to disk.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.