Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

11
  • Awesome, this helps a lot - thank you! This will almost definitely get the right answer. Bounty is yours if you add to this your opinion/recommendation (specifically) on the best way to handle API authentication : ) Commented Sep 11, 2013 at 3:42
  • 1
    While both methods generate a random string, urlsafe_base64 generates a url-safe string. It's all in the name. Unless you want to use your token in your url (which you shouldn't), use hex. Commented Oct 7, 2013 at 22:29
  • 2
    token != password. There is nothing wrong with storing a token in plain text. The problem with storing passwords in plain text is the password can be used somewhere else, that shouldn't be the case with your token. Commented Jan 10, 2016 at 14:10
  • 2
    @fatfrog No. Token == password. If a hacker or a disgruntled employee has access to your database he should not be able to authenticate as a certain user or admin. Commented Jan 10, 2016 at 22:29
  • 1
    I disagree, if a hacker or disgruntled employee has access to your database, then tokens are the last thing you need to worry about. They already have your data. Commented Jan 11, 2016 at 0:12