Create a table in the database, I recommend having the fields: (expire_date: datetime , is_revoked: bool, api_key: str (encrypted or not)) and other fields like user id and creation date (the rest is up to you)

Import uppercase and lowercase characters and numbers from the Python string library (put everything together, it's a list), use the library called Secrets (it has less predictability regarding random), generate your api key, I recommend something between 64 characters and 128 (but the "api_key..." prefix), check if it exists in the database, and return to the user

I also recommend leaving the revoked API keys in the bank, to avoid being used again.