The answer
Hashed, like passwords. Send the raw key once on creation; the user stores it. Compare hashes on each request. If the database is leaked, attackers cannot use the hashes.
Password vs Token vs API Key: When to Use Which
How should API keys be stored in the database?
More FAQs in Password vs Token vs API Key: When to Use Which
Passwords for human login. Tokens (JWT) for session continuity after login. API keys for programmatic access from services, scripts, or third parties. Use all three based on the use case.
In an httpOnly, secure, sameSite cookie for web apps. In secure storage (Keychain, Keystore) for mobile apps. Do not use LocalStorage (open to XSS).
Short: 15 minutes for the access token. Use a refresh token (longer, e.g., 7 days) to get new access tokens. Short expiry limits the damage if a token is stolen.
Still have questions?
Browse all our FAQs or reach out to our support team
Want to upskill yourself?
Your learning library
Small steps. Big possibilities.
Find your next course. Build something great.