How HMAC-SHA256 cut API auth time from 946ms to 1ms
Replacing bcrypt with HMAC-SHA256 plus a server-side secret slashed authentication overhead from nearly a second to under a millisecond, revealing a critical mismatch between password tools and API key security.