urlsafe_b64encode return a byte, which will result in an api key saved with something like b'apikey' I did not tested it but urlsafe_b64decode looks like doing the job also.