user.rb

class User < ActiveRecord::Base
  include Clearance::User
  before_create :generate_api_key

  attr_accessible :time_zone, :email, :password
  validates_uniqueness_of :api_key

  private
  def generate_api_key
    self.api_key = Digest::SHA1.hexdigest(Time.now.to_s + rand(12341234).to_s)[1..24]
  end

end

user_spec.rb

require 'spec_helper'

describe User do
  before(:all) { @user = FactoryGirl.create(:user) }

  it { should have_db_index(:api_key).unique(true) }
  it { should_not allow_mass_assignment_of(:api_key) }

  it "should be able to create a valid user" do
    @user.should be_valid
  end

  it "has an API key after creation" do
    @user.api_key.should_not == nil
  end

  it "should require api_key to match a SHA1 with length 24" do
    @user.api_key.should match /^[a-z0-9]{24}$/
  end

  it "should not allow duplicated API keys" do
    user_two = FactoryGirl.create(:user)
    user_two.api_key = @user.api_key

    user_two.valid?.should equal(false)
  end

end