From fa4e35caf18951226099d85baddb762f57c9b4b7 Mon Sep 17 00:00:00 2001
From: Savio Dsouza <saviodsouza8a@gmail.com>
Date: Tue, 25 Aug 2026 20:41:21 +0530
Subject: [PATCH] Use HMAC with SHA-256 to hash API key

Replace SHA-256 hashing with HMAC for API key.
---
 internal/gateway/apikey.go | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/internal/gateway/apikey.go b/internal/gateway/apikey.go
index 82e48349..a76c0260 100644
--- a/internal/gateway/apikey.go
+++ b/internal/gateway/apikey.go
@@ -334,6 +334,7 @@ func invalidAPIKeyAuthError(err error) *apiError {
 }
 
 func hashAPIKey(key string) string {
-	sum := sha256.Sum256([]byte(key))
-	return base64.RawURLEncoding.EncodeToString(sum[:])
+	mac := hmac.New(sha256.New, pepperKey)
+	mac.Write([]byte(key))
+	return base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
 }