API keys: Length and complexity

Support
2

hi @tpanza !!

I have used Deepwiki to help me analyze our codebase regarding this question and this is what I got:

API Key Length Constraints

Weaviate has different length requirements depending on the API key type:

Dynamic API Keys (Generated by Weaviate)

Dynamic API keys have fixed length components defined in the key generation system key_generation.go:23-29 :

  • Random key component: 32 bytes (44 characters when Base64 encoded)
  • User identifier component: 12 bytes (16 characters when Base64 encoded)
  • Version identifier: 4 characters (v200)

The complete dynamic API key structure is {userIdentifier}_{randomKey}_{version}, then Base64 encoded again key_generation.go:75-78 . This results in a predictable total length.

Static API Keys (User-Configured)

For static API keys configured via environment variables, the validation only enforces that keys cannot have zero length client.go:60-64 . There’s no explicit maximum length constraint in the static key validation.

API Key Display Length

When displaying API key information to users, only the first 3 characters are shown d_b_user_info.go:38-40 and schema.json:86-93 , with validation ensuring this field doesn’t exceed 3 characters db_users.go:176-178 .

Character Types Allowed

Dynamic API Keys

Dynamic API keys use Base64 encoding, which includes:

  • Uppercase letters (A-Z)
  • Lowercase letters (a-z)
  • Numbers (0-9)
  • Plus sign (+)
  • Forward slash (/)

The key generation process creates random bytes and encodes them using Go’s standard Base64 encoding key_generation.go:60-61 and key_generation.go:66-67 .

Static API Keys

Static API keys have no explicit character restrictions in the validation logic - they can contain any characters as long as the length is greater than zero client.go:60-64 .

Notes

The API key validation system distinguishes between static keys (configured via environment) and dynamic keys (generated by Weaviate’s internal system). Dynamic keys follow a strict format with Base64 encoding, while static keys are more flexible but still require non-zero length. The system also includes collision detection for dynamic key generation to ensure uniqueness handlers_db_users.go:428-447 .

Let me know if this helps!

Thanks!