How do you implement API key authentication as an alternative to JWT in NestJS?

Q: How do you implement API key authentication as an alternative to JWT in NestJS?

// npm i passport-headerapikey @Injectable() export class ApiKeyStrategy extends PassportStrategy(HeaderAPIKeyStrategy, 'api-key') { constructor(private apiKeyService: ApiKeyService) { super( { header: 'X-API-Key', prefix: '' }, true, async (apiKey: string, done: Function) => { const keyRecord = await apiKeyService.validate(apiKey); if (!keyRecord) return done(null, false); return done(null, keyRecord.owner); }, ); } } // ApiKeyService — hash keys, never store plain text @Injectable() export class ApiKeyService { async create(userId: number): Promise { const rawKey = randomBytes(32).toString('hex'); const hashedKey = await bcrypt.hash(rawKey, 10); const prefix = rawKey.slice(0, 8); // for fast lookup narrowing const record = await this.apiKeyRepo.save({ userId, hashedKey, prefix }); return { rawKey, id: record.id }; // raw key shown ONCE — never retrievable again } async validate(rawKey: string): Promise { const prefix = rawKey.slice(0, 8); const records = await this.apiKeyRepo.find({ where: { prefix } }); for (const record of records) { if (await bcrypt.compare(rawKey, record.hashedKey)) return record; } return null; } } // FlexibleAuthGuard — accepts JWT or API key @Injectable() export class FlexibleAuthGuard extends AuthGuard(['jwt', 'api-key']) {} @UseGuards(FlexibleAuthGuard) @Get('data') getData() {} Hash API keys with bcrypt before storing — treat them exactly like passwords. Show the raw key only once at creation — not retrievable after that, same as a password. Use a prefix for fast lookup narrowing — avoids comparing every key's hash on every request. Scope API keys to specific permissions and services — avoid granting full access. Support key rotation — allow creating a new key and provide a grace period before the old one expires.

Difficulty: 5/10

NestJS guards, API key storage, security best practices

Create an ApiKeyStrategy using passport-headerapikey that reads from the X-API-Key header. Store keys hashed in the database — never plain text. Use a prefix (first 8 chars) to narrow lookups before bcrypt comparison. Build a FlexibleAuthGuard using AuthGuard(['jwt', 'api-key']) to accept either credential type.

ApiKeyStrategy, hashed storage, and flexible guard

API key security rules:

How do you implement API key authentication as an alternative to JWT in NestJS?

Difficulty: 5/10

NestJS guards, API key storage, security best practices

Create an ApiKeyStrategy using passport-headerapikey that reads from the X-API-Key header. Store keys hashed in the database — never plain text. Use a prefix (first 8 chars) to narrow lookups before bcrypt comparison. Build a FlexibleAuthGuard using AuthGuard(['jwt', 'api-key']) to accept either credential type.

ApiKeyStrategy, hashed storage, and flexible guard

API key security rules:

How do you implement API key authentication as an alternative to JWT in NestJS?

How do you implement API key authentication as an alternative to JWT in NestJS?

Scenario Questions

Follow-up Questions