How I Validate API Keys Without Hitting the Database on Every Request

lamj — Tue, 24 Mar 2026 14:48:35 +0000

Free APIs come with a lot of challenges.

One of the biggest ones is API key validation.

If done poorly, it can lead to:

performance bottlenecks
unnecessary database load
potential security issues

Here’s how I approached this problem.

Authorization and API Key Design

I didn’t want to validate every API key with a database query.

So I made the key self-contained.

Example:

Authorization: PetProjects ppk_v1_1_nonce_signature

Key format:

ppk_version_userId_nonce_signature

Where:

version — key version
userId — user identifier
nonce — random value
signature — HMAC signature

Validation Flow

The validation process is split into two steps.

1. Fast Validation (No Database)

First, the key is validated locally:

structure check
data correctness
HMAC signature verification

This allows us to reject invalid or garbage keys without touching the database.

2. User Check

If the key is valid:

we extract userId
then perform a single database query

Validation Code

function validateApiKey(apiKey: string): ApiKeyPayload | null {
    if (!apiKey.startsWith('ppk_')) return null;

    const parts = apiKey.split('_');
    if (parts.length !== 5) return null;

    const [, version, userIdRaw, nonce, signature] = parts;

    const userId = Number(userIdRaw);
    if (!Number.isInteger(userId)) return null;

    if (!signature || !/^[a-f0-9]{64}$/.test(signature)) return null;

    const payload = `${version}.${userId}.${nonce}`;

    const expectedSignature = crypto.createHmac('sha256', API_KEY_SECRET).update(payload).digest('hex');

    if (signature.length !== expectedSignature.length) return null;

    /**
     * Timing-safe comparison is used here.
     *
     * A regular string comparison (===) can be vulnerable to timing attacks:
     * the comparison stops at the first mismatched character,
     * which may allow an attacker to infer parts of the signature
     * based on response time differences.
     *
     * crypto.timingSafeEqual performs a constant-time comparison,
     * preventing leakage of information about matching characters.
     */
    const isValid = crypto.timingSafeEqual(Buffer.from(signature, 'hex'), Buffer.from(expectedSignature, 'hex'));

    if (!isValid) return null;

    return { version, userId, nonce };
}

Caching

After successful validation, the user is cached:

export const apiKeyCache = new LRUCache<number, CachedUserAuth>({
    max: 10000,
    ttl: 5 * 60 * 1000,
});

Benefits:

no database hit on every request
reduced latency
lower database load

Why TTL = 5 Minutes

The TTL is intentionally short.

If a key leaks:

it only works for a limited time
then requires revalidation via database

This is a trade-off between performance and security.

Final Thoughts

Don’t validate API keys with a database on every request.

Design them to be verifiable locally.

If you're building a free API, this approach can significantly reduce load while keeping things simple.

Example

I’m using this approach in a free API platform I’m building:

https://pet-projects.io/en/apis

I Built Free APIs You Can Use in 1 Minute (No Setup Required)

lamj — Fri, 20 Mar 2026 17:11:35 +0000

Every developer has faced this problem:

You need an API for a pet project, testing, or learning…

and suddenly you’re stuck.

APIs are overcomplicated
Documentation is confusing
Or everything is locked behind a paywall

So I decided to build something simpler.

The idea

I created a set of free APIs with instant access.

No setup.
No waiting.
No friction.

You open the page — and you can start using it immediately.

👉 Explore the API instantly
https://pet-projects.io/en

🔥 Instant Playground

Instead of reading long docs first, you can just try it:

Ready-to-use requests
Code examples in 6 languages
Real responses

Requests are sent in real-time, so you can see how the API behaves.

To use it in your own projects, you’ll need an API key.

Just sign in (via OAuth or email) — your API key will be generated and applied automatically.

Example APIs

Here are a few things you can already use:

JSON storage API
REST Free API
REST Todos API
GraphQL Todos API
(more coming soon — including WebSocket API)

Why I built it this way

Most platforms optimize for:

monetization first, developer experience second

I wanted the opposite:

Developer experience first

Minimal time to first request
Clean UI
No unnecessary steps

Try it yourself

You can test everything here:

https://pet-projects.io/en

Or jump directly into a playground and start sending requests.

Feedback

If you have ideas or feedback — I’d love to hear it.

This is just the beginning, and I’m actively improving the platform.

DEV Community: lamj