3 ms·

So does Stripe. There is nothing wrong with basic auth for api tokens so long as you're using HTTPS.