# ApiKeyGenerator

> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/api/tracon.apikeygenerator/
> Summary: ApiKeyGenerator: A helper that produces a raw API key value and its hash.

<div class="api-provenance">Namespace Tracon · Assembly <code>Tracon.Abstractions.dll</code></div>

A helper that produces a raw API key value and its hash.

```csharp
public static class ApiKeyGenerator
```

<dl class="api-relations"><dt>Inheritance</dt><dd><a href="https://learn.microsoft.com/dotnet/api/system.object">object</a> ← <a href="/api/tracon.apikeygenerator/">ApiKeyGenerator</a></dd><dt>Inherited Members</dt><dd><a href="https://learn.microsoft.com/dotnet/api/system.object.gettype">object.GetType()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.memberwiseclone">object.MemberwiseClone()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.tostring">object.ToString()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.equals#system-object-equals(system-object)">object.Equals(object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.equals#system-object-equals(system-object-system-object)">object.Equals(object?, object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.referenceequals">object.ReferenceEquals(object?, object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.gethashcode">object.GetHashCode()</a></dd></dl>

## Remarks

Format: `ap_{tenant-prefix}_{32-byte-base64url}`
The prefix exists only
for READABILITY; it is not used for authentication — lookup always goes
through the hash produced by [ApiKeyGenerator.ComputeHash](/api/tracon.apikeygenerator/#Tracon_ApiKeyGenerator_ComputeHash_System_String_).

The hash algorithm is SHA-256, not Argon2. The key is
a RANDOM 32-byte value, not a user password; a dictionary attack does not
apply, and a slow hash would only add latency to every request.

## Methods

### <a id="Tracon_ApiKeyGenerator_ComputeHash_System_String_"></a> ComputeHash\(string\)

Computes the SHA-256 hash of a raw key value.

```csharp
public static byte[] ComputeHash(string plaintextKey)
```

#### Parameters

`plaintextKey` [string](https://learn.microsoft.com/dotnet/api/system.string)

The raw value.

#### Returns

 [byte](https://learn.microsoft.com/dotnet/api/system.byte)\[\]

The 32-byte hash.

#### Exceptions

 [ArgumentException](https://learn.microsoft.com/dotnet/api/system.argumentexception)

`plaintextKey` is empty.

### <a id="Tracon_ApiKeyGenerator_Generate_System_String_"></a> Generate\(string\)

Generates a new raw key.

```csharp
public static GeneratedApiKey Generate(string tenantId)
```

#### Parameters

`tenantId` [string](https://learn.microsoft.com/dotnet/api/system.string)

The tenant the key attaches to (read only for the prefix).

#### Returns

 [GeneratedApiKey](/api/tracon.generatedapikey/)

The raw value, its hash, and a display prefix.

#### Exceptions

 [ArgumentException](https://learn.microsoft.com/dotnet/api/system.argumentexception)

`tenantId` is empty.