Struct ApiKey 

pub struct ApiKey<Hash> { /* private fields */ }

Represents a generated API key with its hash.

The key field is stored in a SecureString which automatically zeros its memory on drop, preventing potential memory disclosure.

Implementations

impl<T> ApiKey<T>

pub fn key(&self) -> &SecureString

Returns a reference to the secure API key.

To access the underlying string, use .expose_secret() on the returned SecureString:

let key_str: &str = api_key.key().expose_secret();

Security Note

The key is stored in secure memory that is automatically zeroed on drop. Be careful NOT to clone or log the value unnecessarily.

impl ApiKey<NoHash>

pub fn new(key: SecureString) -> ApiKey<NoHash>

Creates a new API key without a hash.

This is typically used internally before converting to a hashed key.

pub fn into_hashed(self, hasher: &KeyHasher) -> Result<ApiKey<Hash>>

Converts this unhashed key into a hashed key by generating a new random salt and computing the Argon2 hash.

This method is automatically called by ApiKeyManagerV0::generate() and ApiKeyManagerV0::generate_with_expiry().

pub fn into_hashed_with_salt( self, hasher: &KeyHasher, salt: &str, ) -> Result<ApiKey<Hash>>

Converts this unhashed key into a hashed key using a specific salt.

This is useful when you need to regenerate the same hash from the same key, for example in testing or when verifying hash consistency.

Parameters

• hasher - The key hasher to use
• salt - Base64-encoded salt string (32 bytes when decoded)

Example

let key1 = manager.generate(Environment::production()).unwrap();

// Regenerate hash with the same salt
let key2 = ApiKey::new(SecureString::from(key1.key().expose_secret()))
    .into_hashed_with_salt(manager.hasher(), key1.expose_hash().salt())
    .unwrap();

// Both hashes should be identical
assert_eq!(key1.expose_hash(), key2.expose_hash());

pub fn into_key(self) -> SecureString

Consumes the API key and returns the underlying secure string.

impl ApiKey<Hash>

pub fn expose_hash(&self) -> &Hash

Returns a reference to the hash and salt.

The returned Hash struct contains both the Argon2 hash string and the base64-encoded salt used to generate it. The hash should be stored in your database for later verification.

Accessing Fields

Use the auto-generated getter methods:

• .hash() - Returns the Argon2 hash string as &str
• .salt() - Returns the base64-encoded salt as &str

Security Note

Although it’s safe to store the hash, avoid making unnecessary clones or logging the hash to minimize exposure.

Example

// Get the hash for storage
let hash_struct = api_key.expose_hash();

// Access the hash string for database storage
let hash_str: &str = hash_struct.hash();
println!("Store this hash: {}", hash_str);

// Access the salt (if needed for hash regeneration)
let salt: &str = hash_struct.salt();

pub fn into_key(self) -> SecureString

Consumes the API key and returns the underlying secure string.

Trait Implementations

impl<Hash: Debug> Debug for ApiKey<Hash>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.