An API key should be an unpredictable secret with a clear owner and purpose. Generate its secret portion from a cryptographically secure random source with at least 128 bits of entropy, then encode it in a transport-safe form such as unpadded Base64url. Do not derive it from a UUID, timestamp, username, or password.
Show the secret only when created. Store a one-way hash of the secret and a separate non-secret identifier for lookup. Give the key the narrowest useful scopes, an expiration or rotation policy, and a revocation path. Keep it out of URLs, browser bundles, ordinary logs, and analytics. Test both authorized and forbidden actions before relying on a new key. Treat accidental exposure as a reason to revoke and replace it, not merely to hide the old display.
Akousa