title: Generating API tokens using node
body: <p>I am writing an app that will expose an API. The application allows people to create workspaces and add users to them. Each user will have a unique token. When they make an API call, they will use that token (which will identify them as that user using that workspace.</p>
  
  <p>At the moment I am doing this:</p>
  
  <pre><code>var w = new Workspace(); // This is a mongoose model
  w.name = req.body.workspace;
  w.activeFlag = true;
  crypto.randomBytes(16, function(err, buf) {
      if(err){
          next(new g.errors.BadError503("Could not generate token") );
      } else {
          var token = buf.toString('hex');
  
          // Access is the list of users who can access it. NOTE that
          // the token is all they will pass when they use the API
          w.access = {  login: req.session.login, token:token, isOwner: true };
          w.save( function(err){
              if(err){
                  next(new g.errors.BadError503("Database error saving workspace") );
  </code></pre>
  
  <p>Is this a good way to generate API tokens?</p>
  
  <p>Since the token is name+workspace, maybe I should do something like md5(username+workspace+secret_string) ...?</p>