String generateRandomApiKey() {
        // This is the meat of the API key. A random string of chars using the
        // base58 character set. THis is so we have a nice simple set of readable chars
        // without visually similar ones like '0OIl'
        final String randomCode = StringUtil.createRandomCode(
                secureRandom,
                API_KEY_RANDOM_CODE_LENGTH,
                StringUtil.ALLOWED_CHARS_BASE_58_STYLE);

        // Generate a short hash of the randomCode. This is not THE hash. It just acts as a
        // checksum for the random code part of the key, so you can reasonably confidently
        // tell if a string is a stroom api key or not.
        final String randomCodeHash = computeTruncatedHash(randomCode);
        return String.join(API_KEY_SEPARATOR, API_KEY_TYPE, randomCodeHash, randomCode);
    }
Generate a random API key of the form
<pre>{@code sak_<truncated hash>_<random code>}</pre>
where:
<p>
{@code <hash>} is the SHA2-256 hash of {@code <random code>} and truncated to the first
ten characters. This acts as a checksum for the random code part so you can be confident that something
that looks like a stroom api key is actually one. As the prefix is stored in Stroom, it serves as a way
for the user to match a key they have with the API Key record in stroom (that doesn't hold the full key).
</p>
<p>
{@code <random code>} is a string of 128 crypto random characters using the Base58 character set.
</p>

<p>The following <a href="https://gchq.github.io/CyberChef/">cyberchef</a> recipe takes a full API key
as input and highlights the hash part if it is valid, thus indicating that the API key is a valid one.
</p>
<pre>

Register('sak_(.*)_.*$',true,false,false)
Regular_expression('User defined','sak_.*_(.*)$',true,true,false,false,false,false,'List capture groups')
SHA2('256',64,160)
Regular_expression('User defined','^.{10}',true,true,false,false,false,false,'List matches')
Regular_expression('User defined','^$R0$',true,true,false,false,false,false,'Highlight matches')

</pre>
stroom-security/stroom-security-impl/src/main/java/stroom/security/impl/apikey/ApiKeyGenerator.java