Does a UUID Make a Secure API Token?

Watch on Vimeo ↗

So you need to implement an API token for a mobile application to access your backend server. A common practice among Ruby on Rails or Sinatra developers is to use a UUID. But is this a good idea? Is it secure enough? Can you just store it in plaintext in the database?

No. Not for the same reasons you should never store passwords in plaintext in the database. But UUIDs do make great random usernames, and following the same pattern you’d use for securely hashing passwords, you can build a very secure API token system for your application.