Storing API keys for agents: bcrypt, sha256 or encryption?

For randomly generated, high-entropy keys (e.g. 128+ bits from a CSPRNG), a fast hash like SHA-256 is fine — slow hashes exist to protect low-entropy human passwords against guessing, which doesn't apply here, and a fast hash lets you look keys up by hash on every request.

Good practice:

• Show the full key once at creation; store only the hash.
• Store a short non-secret prefix so users can tell keys apart.
• Support revocation and rotation; scope keys to what the agent needs.
• Never log full keys.

Use encryption (not hashing) only if you truly need to show the key again later — usually you don't.