Storing the SHA-2 hash of a 256-bit random key obfuscates the API-key, so an attacker with access to the DB can't use it, but is fast to check so will remain performant.

It doesn't matter how many machines you have or how fast you can compute the SHA. An attacker will not find the API key (work out the math).