The Complete Production SOP: How to Deploy and Run API Key High-Entropy Verification & Masking in Autonomous AI Agents

---
name: "api-key-entropy-masking-guard"
description: "Generate high-entropy API keys and redact sensitive secrets from logging pipelines."
metadata:
  author: "Stripe"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "generate secure api keys"
  - "mask api key in logs"
  - "hash api keys in database"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

import crypto from 'node:crypto';

export interface GeneratedKey {
  rawKey: string;
  hashedKey: string;
  displayPrefix: string;
}

export function generateApiKey(prefix: 'sk_live_' | 'sk_test_'): GeneratedKey {
  // 256 bits of CSPRNG entropy
  const entropy = crypto.randomBytes(32).toString('base64url');
  const rawKey = `${prefix}${entropy}`;
  
  // Deterministic SHA-256 for O(1) indexed database lookups
  const hashedKey = crypto.createHash('sha256').update(rawKey).digest('hex');
  const displayPrefix = `${prefix}${entropy.slice(0, 4)}...${entropy.slice(-4)}`;

  return { rawKey, hashedKey, displayPrefix };
}

export function redactSecrets(message: string): string {
  // Matches prefixes: sk_live_, sk_test_, pk_live_, pk_test_ followed by base64url chars
  const apiKeyRegex = /(?:sk_live_|sk_test_|pk_live_|pk_test_)[A-Za-z0-9_-]{20,}/g;
  return message.replace(apiKeyRegex, (matched) => {
    const prefix = matched.slice(0, 8);
    return `${prefix}************************`;
  });
}

import { describe, it, expect } from 'vitest';
import { redactSecrets } from '../src/middleware/redact-logs';
import { generateApiKey } from '../src/security/key-generator';

describe('API Key Redaction Guard', () => {
  it('masks live API keys in log buffers', () => {
    const { rawKey } = generateApiKey('sk_live_');
    const logBuffer = `User auth failed with token: ${rawKey}`;
    const sanitized = redactSecrets(logBuffer);
    
    expect(sanitized).not.toContain(rawKey);
    expect(sanitized).toMatch(/sk_live_\*{24}/);
  });
});