title: How to expose URL friendly UUIDs?
body: <p>Hello Internet Denizens,</p>
  
  <p>I was reading through a nice <a href="https://tomharrisonjr.com/uuid-or-guid-as-primary-keys-be-careful-7b2aa3dcb439" rel="nofollow noreferrer">database design article</a> and the final determination on how to properly generate DB primary keys was ...</p>
  
  <blockquote>
    <p>So, in reality, the right solution is probably: use UUIDs for keys,
    and don’t ever expose them. The external/internal thing is probably
    best left to things like friendly-url treatments, and then (as Medium
    does) with a hashed value tacked on the end.</p>
  </blockquote>
  
  <p>That is, use UUIDs for internal purposes like db joins, but use a friendly-url for external purposes (like a REST API).  </p>
  
  <p><strong>My question is ... how do you make uniquely identifiable (and friendly) keys for external purposes?</strong>  </p>
  
  <p>I've used several APIs: Stripe, QuickBooks, Amazon, etc. and it seems like they use straight up sequential IDs for things like customers, report IDs, etc for retrieving information.  It makes me wonder if exposing UUIDs as a security risk is a little overblown b/c in theory you should be able to append a where clause to your queries.</p>
  
  <pre><code>SELECT * FROM products where UUID = &lt;supplied uuid&gt; AND owner/role/group/etc = &lt;logged in user&gt;
  </code></pre>
  
  <p>The follow-up question is: <strong>If you expose a primary key, how do people efficiently restrict access to that resource in a database environment?</strong>  Assign an owner to a db row?</p>
  
  <p>Interested in the design responses.</p>
  
  <p>Potential Relevant Posts for Further Reading:</p>
  
  <p><a href="https://stackoverflow.com/questions/7114694/should-i-use-uuids-for-resources-in-my-public-api">Should I use UUIDs for resources in my public API?</a></p>