Looking at the best practices in terms of storing API keys, how is it possible to hash the key and still allow the user to view it themselves. If an email is used to encrypt/decrypt (as a salt) with a secret on the server, how would it be possible for a user to provide an API key (say in a POST request) and find the match in the database without also providing the email.
If an API key is hashed the same as a password, it won't be accessible for the user, which would be ideal instead of having to refresh the key if it is ever forgotten.
In essence, what would be the most secure way (since nothing can ever be 100% secure) to store an API key that would still allow a user to view it if needed, and also be able to query the database using the raw key as a where clause?
For what it's worth, I'm using MongoDB with Prisma (inside Next.js api routes).