API Key Convention

Question

Are all API keys hexadecimal numbers some kind of unwritten convention?

Answer 1

Executing the md5 hash on some semi-random data (e.g. timestamp + userid + key) is a quick way to generate a fixed-length key that is hard to guess.

Since md5 produces hexadecimal output, people just use it directly. They can be converted to a high base, but there is usually no big push, because the difference in transmitted data is so small.

Answer 2

No, API keys are hexadecimal based on a written agreement.

API keys are UUID based.

"UUIDs are documented as part of ISO / IEC 11578: 1996" Information technology. Open Systems Interconnection - Remote Procedure Call (RPC) ", and most recently in ITU-T Rec. X.667 | ISO / IEC 9834-8: 2005, the IETF published Track Standard RFC 4122, which is technically equivalent to ITU-T Rec. X .667 | ISO / IEC 9834-8. "

The MD5 keys used for most APIs are a version of the UUID.