🔑 How to Generate API Keys and Database Credentials

📋 Original Values (What You Had)

Based on the codebase, these were the original hardcoded values:

API Key

cfOVW6zD8zipV0xscnyA7KBrun167/nUIJu95FKNteI=

- Format: Base64-like string - Length: ~43 characters - How it was likely created: - Manually typed or copied from somewhere - Possibly generated with a simple tool - Not cryptographically secure

Database Password

pcbstackup123

- Format: Simple text password - Length: 12 characters - How it was likely created: - Manually typed as a simple default - Not secure (dictionary word + numbers)

---

✅ How to Generate Secure Replacements

Method 1: Generate API Key (Recommended)

Using OpenSSL (most secure):

# Generate 32-byte random key, base64 encoded (44 characters)
openssl rand -base64 32

# Example output:
# Kx9mP2vQ7wR4tY8uI3oA6sD1fG5hJ0kL9zX4cV2bN7=

Using PowerShell (if OpenSSL not available):

# Generate random bytes and convert to base64
$bytes = New-Object byte[] 32
[System.Security.Cryptography.RandomNumberGenerator]::Fill($bytes)
[Convert]::ToBase64String($bytes)

Using Python:

import secrets
import base64

# Generate 32 random bytes
key = secrets.token_bytes(32)
# Encode to base64
api_key = base64.b64encode(key).decode('utf-8')
print(api_key)

Using Node.js:

const crypto = require('crypto');
const apiKey = crypto.randomBytes(32).toString('base64');
console.log(apiKey);

---

Method 2: Generate Database Password (Recommended)

Using PowerShell:

# Generate strong password (20+ characters)
function Generate-Password {
    $length = 24
    $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*"
    $password = ""
    for ($i = 0; $i -lt $length; $i++) {
        $password += $chars[(Get-Random -Maximum $chars.Length)]
    }
    return $password
}

Generate-Password

Using OpenSSL:

# Generate random password (24 characters, alphanumeric + symbols)
openssl rand -base64 18 | tr -d "=+/" | cut -c1-24

Using Python:

import secrets
import string

def generate_password(length=24):
    alphabet = string.ascii_letters + string.digits + "!@#$%^&*"
    password = ''.join(secrets.choice(alphabet) for i in range(length))
    return password

print(generate_password())

Online Tools (if needed): - https://www.lastpass.com/features/password-generator - https://1password.com/password-generator/ - Generate 20+ characters, mixed case, numbers, symbols

---

🚀 Quick Setup Script

Create a PowerShell script to generate everything at once:

# Generate all secrets at once
Write-Host "🔐 Generating Secure Secrets..." -ForegroundColor Cyan
Write-Host ""

# Generate API Key
$apiKeyBytes = New-Object byte[] 32
[System.Security.Cryptography.RandomNumberGenerator]::Fill($apiKeyBytes)
$apiKey = [Convert]::ToBase64String($apiKeyBytes)

# Generate Database Password
$dbPasswordLength = 24
$dbPasswordChars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*"
$dbPassword = ""
for ($i = 0; $i -lt $dbPasswordLength; $i++) {
    $dbPassword += $dbPasswordChars[(Get-Random -Maximum $dbPasswordChars.Length)]
}

Write-Host "✅ Generated Secrets:" -ForegroundColor Green
Write-Host ""
Write-Host "API_KEY=$apiKey" -ForegroundColor Yellow
Write-Host "POSTGRES_PASSWORD=$dbPassword" -ForegroundColor Yellow
Write-Host ""
Write-Host "📋 Copy these to your .env file" -ForegroundColor Cyan

Save as scripts/security/generate-secrets.ps1 and run:

.\scripts\security\generate-secrets.ps1

---

📝 Step-by-Step: Setting Up New Secrets

Step 1: Generate New API Key

# Generate API key
openssl rand -base64 32
# Copy the output

Step 2: Generate Database Password

# Generate password (use one of the methods above)
# Or use the PowerShell function from Method 2

Step 3: Update Your .env File

# Open or create root .env file
notepad .env

# Add these lines:
API_KEY=YOUR_GENERATED_API_KEY_HERE
POSTGRES_USER=postgres
POSTGRES_PASSWORD=YOUR_GENERATED_PASSWORD_HERE
POSTGRES_DB=pcbstackup

Step 4: Update Database (if already exists)

If your database already exists with the old password, you need to change it:

Option A: Using Docker Compose (if using Docker)

# Stop containers
docker-compose down

# Update .env with new password

# Remove old database volume (WARNING: This deletes data!)
docker volume rm pcb_stackup_generator_postgres_data

# Start fresh
docker-compose up -d

Option B: Using PostgreSQL directly

-- Connect to PostgreSQL
psql -U postgres

-- Change password
ALTER USER postgres WITH PASSWORD 'your_new_password_here';

Step 5: Update Frontend API Key

If frontend uses VITE_API_KEY, update it in .env:

VITE_API_KEY=YOUR_GENERATED_API_KEY_HERE

---

🔍 Why the Old Values Were Insecure

API Key Issues:

• cfOVW6zD8zipV0xscnyA7KBrun167/nUIJu95FKNteI=
• Looks random but may have been manually created
• No evidence of cryptographic generation
• Exposed in git history

Database Password Issues:

• pcbstackup123
• Too simple (dictionary word + numbers)
• Only 12 characters
• Easily guessable
• Common pattern (project name + numbers)

---

✅ Security Requirements for New Secrets

API Key:

• ✅ Length: 32+ bytes (44+ characters when base64 encoded)
• ✅ Randomness: Cryptographically secure random generator
• ✅ Format: Base64 encoded random bytes
• ✅ Storage: Environment variable only (never in code)

Database Password:

• ✅ Length: 20+ characters (24+ recommended)
• ✅ Complexity: Mixed case, numbers, symbols
• ✅ Randomness: Cryptographically secure
• ✅ Storage: Environment variable only

---

🧪 Verify Your New Secrets

After generating, verify they work:

# 1. Check API key format (should be base64, ~44 chars)
$apiKey = "YOUR_NEW_KEY"
Write-Host "Length: $($apiKey.Length)"
Write-Host "Format OK: $($apiKey -match '^[A-Za-z0-9+/=]+$')"

# 2. Check password strength
$password = "YOUR_NEW_PASSWORD"
$hasUpper = $password -cmatch '[A-Z]'
$hasLower = $password -cmatch '[a-z]'
$hasNumber = $password -match '\d'
$hasSymbol = $password -match '[!@#$%^&*]'
$isLong = $password.Length -ge 20

Write-Host "Password Strength:"
Write-Host "  Length >= 20: $isLong"
Write-Host "  Has uppercase: $hasUpper"
Write-Host "  Has lowercase: $hasLower"
Write-Host "  Has numbers: $hasNumber"
Write-Host "  Has symbols: $hasSymbol"

---

📚 Best Practices

1. Generate once, store securely:
2. Generate secrets when setting up
3. Store in .env file (not in git)

4. Use password manager for backup

5. Rotate regularly:

6. API keys: Every 6-12 months

7. Database passwords: When compromised or annually

8. Different keys for different environments:

9. Development: Test keys
10. Production: Real, secure keys

11. Staging: Separate from production

12. Never reuse:

13. Don't use the same key for multiple services
14. Don't reuse old keys

---

🆘 If You Lose Your Secrets

API Key:

• Generate a new one
• Update .env file
• Restart services
• Update frontend if it uses the key

Database Password:

• If you forget: Reset via PostgreSQL admin
• If compromised: Generate new one, update database, update .env

---

💡 Quick Reference

Generate API Key:

openssl rand -base64 32

Generate Password:

# PowerShell one-liner
-join ((65..90) + (97..122) + (48..57) + (33,64,35,36,37,94,38,42) | Get-Random -Count 24 | % {[char]$_})

Where to put them: - Root .env file (for Docker Compose) - Or backend/.env (for local development)