Skip to main content

Fake API Key & Token Generator

MOCK DATA

Clearly fake API keys, JWTs and hex/base64 secrets — structurally valid enough to exercise parsers and middleware, cryptographically meaningless by design.

Generated test data for fixtures and development

Base URL
/api/tokens
Category
Developer Tools
Capabilities
1 route Seedable
Last updated
July 30, 2026

GET /api/tokens Generate clearly fake API keys, JWTs and raw secrets

Live requestRuns against the public API
No key required
GET/api/tokens?count=5&seed=42

Request parameters

Credential shape: apiKey (prefix + 32 base62 chars), jwt (decodable header.payload.signature), hex (raw lowercase hex secret) or base64 (raw padded base64 secret).

Key prefix for type=apiKey (1–16 characters, e.g. pk_live_). Defaults to sk_test_. Only applies to apiKey — set on any other type it is ignored with a warning.

Secret strength in random bytes for type=hex (output is bytes × 2 characters) and type=base64 (decodes back to exactly this many bytes). Defaults to 32. Ignored with a warning for other types.

Advanced response options7 options

How many records to generate (1–100).

Deterministic output: the same seed always returns the same records. Omit for random (the used seed is echoed in meta.seed).

Return only these fields (comma-separated). Mutually exclusive with 'exclude'.

Return all fields except these (comma-separated).

Response format: json envelope, ndjson (one record per line) or csv.

Pretty-print the JSON response.

Drop the envelope: return the raw array/object without data/meta wrapper.

Response

Example parameters are ready. Send the request to inspect the live response.

Route reference

Code, request parameters, response fields and verified examples
Code samples Ready-to-copy requests in 4 languages
Choose a code sample language 
curl "https://randomapi.dev/api/tokens?count=5&seed=42"
const res = await fetch("https://randomapi.dev/api/tokens?count=5&seed=42");
const { data, meta } = await res.json();
import requests

data = requests.get("https://randomapi.dev/api/tokens?count=5&seed=42").json()["data"]
$json = json_decode(file_get_contents(
  "https://randomapi.dev/api/tokens?count=5&seed=42"
), true);
$data = $json["data"];
Parameters Route-specific request inputs 3
type enum

Credential shape: apiKey (prefix + 32 base62 chars), jwt (decodable header.payload.signature), hex (raw lowercase hex secret) or base64 (raw padded base64 secret).

default: apiKey
allowed: apiKey | jwt | hex | base64
example: type=jwt
prefix string

Key prefix for type=apiKey (1–16 characters, e.g. pk_live_). Defaults to sk_test_. Only applies to apiKey — set on any other type it is ignored with a warning.

allowed: 1 – 16
example: prefix=pk_live_
bytes int

Secret strength in random bytes for type=hex (output is bytes × 2 characters) and type=base64 (decodes back to exactly this many bytes). Defaults to 32. Ignored with a warning for other types.

allowed: 8 – 64
example: bytes=16
Universal parameters Shared response and formatting options 7
count int

How many records to generate (1–100).

default: 10
allowed: 1 – 100
example: count=3
seed int

Deterministic output: the same seed always returns the same records. Omit for random (the used seed is echoed in meta.seed).

example: seed=42
fields list

Return only these fields (comma-separated). Mutually exclusive with 'exclude'.

example: fields=value,type
exclude list

Return all fields except these (comma-separated).

example: exclude=claims
format enum

Response format: json envelope, ndjson (one record per line) or csv.

default: json
allowed: json | ndjson | csv
example: format=csv
pretty boolean

Pretty-print the JSON response.

default: false
example: pretty=true
unwrap boolean

Drop the envelope: return the raw array/object without data/meta wrapper.

default: false
example: unwrap=true
Response schema Fields returned in each record 3
value string

The generated credential in the requested format.

example: sk_test_h2vTQEnAVoZkW8eFqYbJ3R7xLcM5pDgU

type string

Echo of the type parameter for this record: apiKey | jwt | hex | base64.

example: apiKey

claims object nullable

For type=jwt only: the token's decoded payload (sub, name, iat, exp) so tests can assert against it without a decoder. null for all other types.

example: {"sub":"user_4f9a2c1e8b3d","name":"Emily Carter","iat":1765800000,"exp":1765803600}

Documented examples

Build-generated requests and complete responses 5
Five reproducible test API keys
GET /api/tokens?count=5&seed=42 
{
  "data": [
    {
      "value": "sk_test_TfbJW24PmwhOdMnXJsfoKYnrrJ1wj6NV",
      "type": "apiKey",
      "claims": null
    },
    {
      "value": "sk_test_20RWzAHWdjtnnhfOwoFKrxZ5oDQOTCvX",
      "type": "apiKey",
      "claims": null
    },
    {
      "value": "sk_test_r7LSZ0a29n0LfmVCYwumy1hZlG4POxaN",
      "type": "apiKey",
      "claims": null
    },
    {
      "value": "sk_test_9a2AxqgJ8v4ux9zwiS1eSIPb5Nk12bGN",
      "type": "apiKey",
      "claims": null
    },
    {
      "value": "sk_test_piRF2hvtqHpXj4qeMYww8r4J4FT7NEem",
      "type": "apiKey",
      "claims": null
    }
  ],
  "meta": {
    "endpoint": "tokens",
    "count": 5,
    "seed": 42,
    "params": {
      "type": "apiKey",
      "prefix": "sk_test_"
    },
    "generatedAt": "2026-07-30T15:14:08.000Z"
  }
}
Publishable-style keys with a custom prefix
GET /api/tokens?prefix=pk_live_&count=3&seed=7 
{
  "data": [
    {
      "value": "pk_live_gqYBkTuBGBQyP6kmpt6eAETzQ4wrbNKW",
      "type": "apiKey",
      "claims": null
    },
    {
      "value": "pk_live_ZbKm1uoKneiYeYpqHLQYDtaQdt0hlYYZ",
      "type": "apiKey",
      "claims": null
    },
    {
      "value": "pk_live_Sldk36kpkuDjMeNu5oiDfoavt4ho84ud",
      "type": "apiKey",
      "claims": null
    }
  ],
  "meta": {
    "endpoint": "tokens",
    "count": 3,
    "seed": 7,
    "params": {
      "type": "apiKey",
      "prefix": "pk_live_"
    },
    "generatedAt": "2026-07-30T15:14:08.000Z"
  }
}
Decodable fake JWTs (claims included)
GET /api/tokens?type=jwt&count=2&seed=11 
{
  "data": [
    {
      "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImZha2UifQ.eyJzdWIiOiJ1c2VyXzVmNjdiY2QyYzc2ZiIsIm5hbWUiOiJHcmVnZyBBbHRlbndlcnRoIiwiaWF0IjoxNzg1MTM2ODU2LCJleHAiOjE3ODUxNDA0NTZ9.PyXNKxhPqYPTLT7a50bVjW-MqVtkGM-89RvB5KhRh2U",
      "type": "jwt",
      "claims": {
        "sub": "user_5f67bcd2c76f",
        "name": "Gregg Altenwerth",
        "iat": 1785136856,
        "exp": 1785140456
      }
    },
    {
      "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImZha2UifQ.eyJzdWIiOiJ1c2VyX2Y1ZmQzYmI0MGMxMyIsIm5hbWUiOiJFdWdlbmUgUHJpY2UiLCJpYXQiOjE3ODM5NDYxOTgsImV4cCI6MTc4Mzk0OTc5OH0.5YAsDVcBBg-aNMwtsjfMNTMDryPxvjhduo-Qw3N7yH4",
      "type": "jwt",
      "claims": {
        "sub": "user_f5fd3bb40c13",
        "name": "Eugene Price",
        "iat": 1783946198,
        "exp": 1783949798
      }
    }
  ],
  "meta": {
    "endpoint": "tokens",
    "count": 2,
    "seed": 11,
    "params": {
      "type": "jwt"
    },
    "generatedAt": "2026-07-30T15:14:08.000Z"
  }
}
16-byte hex secrets (32 chars each)
GET /api/tokens?type=hex&bytes=16&count=5 
{
  "data": [
    {
      "value": "7aad995187091268c7f1b364a45dcc8b",
      "type": "hex",
      "claims": null
    },
    {
      "value": "0a017286fd2c4986a4bbe6cdcab4aa63",
      "type": "hex",
      "claims": null
    },
    {
      "value": "db1e59779001970825cd0258a9c98133",
      "type": "hex",
      "claims": null
    },
    {
      "value": "2795092df4d8af5123ed11ebf426fef2",
      "type": "hex",
      "claims": null
    },
    {
      "value": "d5b76f400cb3ece5da48d388bb10d8a9",
      "type": "hex",
      "claims": null
    }
  ],
  "meta": {
    "endpoint": "tokens",
    "count": 5,
    "seed": 42,
    "params": {
      "type": "hex",
      "bytes": 16
    },
    "generatedAt": "2026-07-30T15:14:08.000Z"
  }
}
48-byte base64 session secrets
GET /api/tokens?type=base64&bytes=48&count=3 
{
  "data": [
    {
      "value": "eq2ZUYcJEmjH8bNkpF3Mi1Hiq89Tjs3c208F8bsbX4FhNsYa2RTP8/yBfi6BR0qF",
      "type": "base64",
      "claims": null
    },
    {
      "value": "CgFyhv0sSYaku+bNyrSqY/HRQVbe95MVzzhuZHk07or+z6jgkADa4GVTXFiAV1zT",
      "type": "base64",
      "claims": null
    },
    {
      "value": "2x5Zd5ABlwglzQJYqcmBM43y6sj5BbSTxUMQaWX0lmB+BVtcVawM5OItz/lePL2Y",
      "type": "base64",
      "claims": null
    }
  ],
  "meta": {
    "endpoint": "tokens",
    "count": 3,
    "seed": 42,
    "params": {
      "type": "base64",
      "bytes": 48
    },
    "generatedAt": "2026-07-30T15:14:08.000Z"
  }
}

About this API

Coverage, behavior and common use cases

Coverage & behavior

Generates clearly fake credentials: every value is structurally valid — the right shape, alphabet and length to exercise parsers, validators, masking and secret-scanning logic — but cryptographically meaningless. Nothing is signed with or derived from a real secret, and nothing can authenticate anywhere. The defaults advertise it too: API keys start with sk_test_ and JWT headers carry "kid": "fake".

Four shapes via type:

  • apiKey (default) — prefix + 32 base62 characters, Stripe-style. Change the look with prefix (1–16 chars, e.g. pk_live_; default sk_test_).
  • jwt — a genuine three-part header.payload.signature structure in unpadded base64url. The header is {"alg":"HS256","typ":"JWT","kid":"fake"}; the payload carries sub, name, a past iat (between 1 hour and 30 days before the request) and exp = iat + 3600. It decodes in any JWT library (or jwt.io), and the decoded payload is returned alongside as the claims field so your assertions don't need a decoder. The signature is just 32 random bytes — verification fails by design.
  • hex — bytes random bytes as lowercase hex (bytes × 2 characters; the default 32 bytes gives a fake-SHA-256-sized 64-char string).
  • base64 — bytes random bytes as standard, padded base64.

prefix only applies to apiKey, and bytes only to hex and base64 — setting one on the wrong type adds a notice to meta.warnings instead of silently no-opping. With a seed, the same request returns byte-identical credentials forever.

Use it for

  • Fill .env.example files, fixtures and demo dashboards with credentials that are obviously not real
  • Test JWT decoding middleware end-to-end — tokens parse like real ones and the claims field tells you exactly what to assert
  • Generate seed-stable fake API keys so secret-masking and log-redaction logic can be tested in CI

Frequently asked questions

Practical answers about this endpoint 3
Are the JWTs signed with a real secret?

They decode like real ones — header, payload with readable claims, signature — but they're fake and won't verify against any real issuer. That's the point.

Can I mimic my provider's key format?

Yes — type=apiKey with the default sk_test_ prefix or your own prefix, plus bytes for length, matches most providers' shapes.

Is it safe to commit these to fixtures?

Yes — they look real to parsers but unlock nothing. If your secret scanner flags them, allow-list the fake prefix you chose.

Standards & references

Primary sources behind the contract

Related APIs

Useful next tools in the catalog
UUID & ID Generator API MOCK DATA

Generate seed-reproducible UUIDs and compact IDs, or inspect any canonical UUID's RFC 9562 variant, version and UUIDv7 timestamp fields.
Random Password Generator API MOCK DATA

Random password generator with length, uppercase/digit/symbol toggles, look-alike exclusion, and an honest entropy estimate with a strength rating.
Fake Git Commit API MOCK DATA

Fake git commits — Conventional Commits or plain messages, 40-char hashes, safe author emails, dates in your range and realistic diff stats. Fully seedable.
Random Internet Data API MOCK DATA

Random internet building blocks — valid IPv4/IPv6 addresses, locally-administered MACs, non-resolvable .test domains and URLs, slugs, ports and TLDs.
JWT Claims Inspector and Decoder API REAL DATA

Decode any compact JWS/JWT — header, payload, registered claims and exp/nbf/iat evaluated at a real or supplied clock. Signatures are never verified.
Mock LLM Completion & Streaming Response API MOCK DATA

Mock LLM completion fixtures with coherent token usage, tool calls and a replayable delta stream whose chunks concatenate to the exact message.