title: How should static auth keys for stateless services be generated and stored?
body: <p>I am building a stateless service (API) and will be generating static keys for users to access it.  I would like to know the best practices for generating these keys and then storing them.</p>
  
  <p>I use the native PHP functions here to generate hashes of passwords for users of my web application: <a href="http://php.net/manual/en/function.password-hash.php" rel="nofollow">http://php.net/manual/en/function.password-hash.php</a></p>
  
  <p>Since my web application uses cookie sessions I only have to authenticate a user's credentials once upon login.  So the intentional slowness of that method is beneficial.  But with my API the static key must be authenticated per request, and I don't want to add a large static 50 or 100ms to every request as I hash their key and compare it with what I have stored.</p>
  
  <p>So how should I be generating and storing static keys so that they are both secure and do not cause requests to be slow?</p>