I agree that HTTP Basic over SSL is probably fine for requests from a server, in order to prevent sniffing of the connection. However, I've recently been think

I agree that HTTP Basic over SSL is probably fine for requests from a server, in order to prevent sniffing of the connection. However, I've recently been thinking about how to use a third-party API directly from client-side Javascript, or even from a resident application. If you're doing that, then you really need some way to use keys with validity that is limited by time or scope. In that case, HMAC offers some real advantages.