package auth

import (
	"crypto/sha256"
	"encoding/hex"
)

// HashAPIKey returns a stable, non-reversible fingerprint of a raw API
// key for storage and lookup (API keys are high-entropy random tokens,
// not user-chosen passwords, so a plain fast hash is sufficient here).
func HashAPIKey(raw string) string {
	sum := sha256.Sum256([]byte(raw))
	return hex.EncodeToString(sum[:])
}