API key security: design the lifecycle, not just the format

import { createHash, randomBytes, timingSafeEqual } from "crypto";

function generateKey(env: "live" | "test") {
  const prefix = env === "live" ? "pk_live_" : "pk_test_";
  const raw = randomBytes(32).toString("base64url");
  const full = prefix + raw;
  return {
    full,                              // Show once, never log
    hash: createHash("sha256").update(full).digest("hex"), // Store
    preview: prefix + raw.slice(0, 12) + "..."              // Display
  };
}

function verify(raw: string, storedHash: string) {
  const hash = createHash("sha256").update(raw).digest("hex");
  return timingSafeEqual(Buffer.from(hash), Buffer.from(storedHash));
}