3 ms·
Ah, that's fair I guess the trade-off is here that the api key cannot then be retrieved from a GUI either (because the server doesn't actually know the origina
by veesahni 14y ago
Ah, that's fair
I guess the trade-off is here that the api key cannot then be retrieved from a GUI either (because the server doesn't actually know the original key!) .. from a UX perspective, most companies show your active keys in a GUI with ability to selectively remove or replace.
Though I can't think of a mainstream API that hasn't let me retrieve api key from GUI
- poutine 14y agoIndeed, this is where common usage hasn't really caught up with best practice. It really is no better than showing the user their cleartext password. Ideally you'd regenerate the key each time the user wants to show it or just use OAuth 2.0 (it's not as bad as everyone says it is).