Struct ApiKey 

pub struct ApiKey<Hash> { /* private fields */ }

Represents a generated API key with its hash.

The key field is stored in a SecureString which automatically zeros its memory on drop, preventing potential memory disclosure.

Implementations

impl<T> ApiKey<T>

pub fn key(&self) -> &SecureString

Returns a reference to the secure API key.

To access the underlying string, use .expose_secret() on the returned SecureString:

let key_str: &str = api_key.key().expose_secret();

Security Note

The key is stored in secure memory that is automatically zeroed on drop. Be careful NOT to clone or log the value unnecessarily.

impl ApiKey<NoHash>

pub fn new(key: SecureString) -> ApiKey<NoHash>

Creates a new API key without a hash.

This is typically used internally before converting to a hashed key.

pub fn into_hashed(self, hasher: &KeyHasher) -> Result<ApiKey<Hash>>

Converts this unhashed key into a hashed key by generating a new random salt and computing the Argon2 hash.

This method is automatically called by ApiKeyManagerV0::generate() and ApiKeyManagerV0::generate_with_expiry().

pub fn into_hashed_with_phc( self, hasher: &KeyHasher, phc_hash: &str, ) -> Result<ApiKey<Hash>>

Converts this unhashed key into a hashed key using a specific PHC hash string.

This is useful when you need to regenerate the same hash from the same key, for example in testing or when verifying hash consistency. The salt is extracted from the provided PHC hash string.

Parameters

• hasher - The key hasher to use
• phc_hash - An existing PHC-formatted hash string to extract the salt from

Example

let key1 = manager.generate(Environment::production()).unwrap();

// Regenerate hash with the same salt (extracted from the PHC hash)
let key2 = ApiKey::new(SecureString::from(key1.key().expose_secret()))
    .into_hashed_with_phc(manager.hasher(), key1.expose_hash().hash())
    .unwrap();

// Both hashes should be identical
assert_eq!(key1.expose_hash(), key2.expose_hash());

pub fn into_key(self) -> SecureString

Consumes the API key and returns the underlying secure string.

impl ApiKey<Hash>

pub fn expose_hash(&self) -> &Hash

Returns a reference to the hash.

The returned Hash struct contains the Argon2 hash string in PHC format. The PHC format embeds all necessary information including the salt, algorithm parameters, and hash output. This single string should be stored in your database for later verification.

Accessing Fields

Use the auto-generated getter method:

• .hash() - Returns the PHC-formatted hash string as &str

PHC Format

The hash string follows the PHC format: $argon2id$v=19$m=19456,t=2,p=1$<salt>$<hash>

The salt is embedded in the hash string and can be extracted if needed using the password_hash crate’s PasswordHash::new() method.

Security Note

Although it’s safe to store the hash, avoid making unnecessary clones or logging the hash to minimize exposure.

Example

// Get the hash for storage
let hash_struct = api_key.expose_hash();

// Access the hash string for database storage
let hash_str: &str = hash_struct.hash();
println!("Store this hash: {}", hash_str);

pub fn into_key(self) -> SecureString

Consumes the API key and returns the underlying secure string.

Trait Implementations

impl<Hash: Debug> Debug for ApiKey<Hash>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.