I'm building an application where users can be a part of groups, and can obtain and distribute URLs from the group page that allow anyone who clicks on them to join said group. Groups should not otherwise be join-able without a proper URL (or an invite from within the system, but that's another matter).
Currently, I have it set up so a URL to a group looks something like "host/JoinGroup?groupKey=ABCDEF", where the groupKey is a ciphertext created by encrypting the group's ID# using AES with a static key and IV across all groups (which I know is normally bad). Doing this, I can decrypt the key on the server and use it to determine which group the user should join so I can update the database. My goal with this is not to hide what is being encrypted, but rather to make sure it is very hard to generate a valid groupKey and join any group they want.
With this in mind, is this method insecure? I know the standard IV reuse attack allows someone to find the XOR'd plaintext, but I'm not trying to hide the plaintext, just the key itself and valid ciphertexts, so that an attacker can't generate valid URLs. Should I change the IV used for each group, but continue using a static key? Would using a keyed hash (i.e., "host/JoinGroup?groupId=5&groupKey=hmac_of_groupId") be better?