title: Why does PayPal use HTTP Request Headers for its API authentication?
body: <p>I'm just reading Paypal's API documentation, e.g. <a href="https://cms.paypal.com/us/cgi-bin/?cmd=_render-content&amp;content_ID=developer/e_howto_api_ACGettingStarted" rel="nofollow">Adaptive Accounts API</a></p>
  
  <p>My question: What's the reason/advantage of using (custom?) HTTP Request Headers for authentication instead of "normal" POST/GET (or even COOKIE) variables?</p>
  
  <p>In the mentioned example PayPal uses the following HTTP Request Headers:</p>
  
  <pre><code>X-PAYPAL-SECURITY-USERID
  X-PAYPAL-SECURITY-PASSWORD
  X-PAYPAL-SECURITY-SIGNATURE
  X-PAYPAL-APPLICATION-ID
  X-PAYPAL-DEVICE-IPADDRESS
  X-PAYPAL-REQUEST-DATA-FORMAT
  </code></pre>