Use hmac-sha256 for api keys
rename ApiKey.generate to .encrypt