Currently I am working on a public api that uses token authentication. The token is a 32 bit random hex that is shared with the user and then stored in our database as an HMAC digest using a secret key. The token is not stored except for the first 4 characters.
My question is, is it safe to store the prefix like this?
My intuition tells me that it is not safe as it gives any attacker the beginning of the correct answer which therefore shortens the process of trying to brute force our secret key. I am wondering what someone with more expertise than I have thinks about this.
Thank you in advance.