This article just makes a big huff about nothing. go to http://api.stripe.com http://api.stripe.com - what you get is immediately a redirect to https, and a 401

This article just makes a big huff about nothing. go to http://api.stripe.com http://api.stripe.com - what you get is immediately a redirect to https, and a 401 which requests the auth. It does not request http basic over http, it requests it over https. The issue is if you are a dumb developer, you might supply authentication over http, which would make that insecure. However, what I see it is requesting is an API key, which normally with payment providers, only allows making a charge, or refunding a charge, provided you know the charge ID. So your financial risk is very low even if someone knows your API key. They also usually recommend you change your API key at least once a month.