Most programming languages do not use secure random number generators. As you suggested it is not always wise to use UUIDs for API keys if you are not sure abou

Most programming languages do not use secure random number generators. As you suggested it is not always wise to use UUIDs for API keys if you are not sure about the nature of the PRNG. Python for example uses os.urandom for random UUID generation (uuid4), as can be seen in the source: https://github.com/python/cpython/blob/3.5/Lib/uuid.py#L603 https://github.com/python/cpython/blob/3.5/Lib/uuid.py#L603 The standard library guarantees that os.urandom is "[...] suitable for cryptographic use." (https://docs.python.org/3.5/library/os.html#os.urandom https://docs.python.org/3.5/library/os.html#os.urandom) I'm not sure about other languages, so it might always be a good idea to look it up in the source code.