title: Storing API keys on server
body: <p>I have a service where users each have an API key. I need to store the keys so that they can be used to validate API requests.</p>
  
  <p>If I store the keys in plaintext in my database, I'm worried about the scenario of someone getting access to the db, grabbing all the plaintext api keys, then using them to impersonate others (there will likely be bigger problems if someone got access to the db, though).</p>
  
  <p>This is similar to storing user passwords, where you just store the hash and validate using that - however most APIs let you view your API keys, which means they need to be stored in some recoverable way.</p>
  
  <p>Is there a best practice for this?</p>