The 946-Millisecond Tax: Migrating API Key Auth from Bcrypt to HMAC-SHA256

I never profiled our authentication middleware. Why would I? It's a key check. The request comes in, you verify the key, you move on. It's plumbing. Then one afternoon I stuck a timer on it and watched it print 946 milliseconds. I re-ran it. Same. Every authenticated request to our API was spending nearly a full second deciding whether the caller was allowed in, before it did a single useful thing. We were hashing API keys with bcrypt. It felt like the right thing to do. It wasn't. The 100-Milli