title: Securing an API: SSL & HTTP Basic Authentication vs Signature
body: <p>When designing an API for our web app, we'll use the their subdomain as the 'username' and generate an API key/shared secret. Firstly, is it ok to use the subdomain as the username? I don't see the benefit of generating another key.</p>
  
  <p>Different APIs seem to do one of two things:</p>
  
  <ol>
  <li><strong>Use HTTP Basic Authentication with SSL</strong></li>
  </ol>
  
  <p>In every request the username is set to the subdomain and the password to the API key. Since we're using SSL then this should be safe from spoofing.</p>
  
  <p>Notable APIs: <strong><a href="http://checkout.google.com/support/sell/bin/answer.py?hl=en&amp;answer=57519" rel="noreferrer">Google Checkout</a>, <a href="http://developers.freshbooks.com/" rel="noreferrer">Freshbooks</a>, <a href="http://develop.github.com/p/general.html" rel="noreferrer">GitHub</a>, <a href="http://www.zendesk.com/api/rest-introduction" rel="noreferrer">Zendesk</a></strong></p>
  
  <ol start="2">
  <li><strong>Create a Signature of the Request with the Shared Secret</strong></li>
  </ol>
  
  <p>Normally achieved by ordering the key/value pairs and using HMAC-SHA1 with the shared secret to generate the signature. The signature is then sent with the request and verified at the other end.</p>
  
  <p>Notable APIs: <strong><a href="http://checkout.google.com/support/sell/bin/answer.py?hl=en&amp;answer=57519" rel="noreferrer">Google Checkout</a>, <a href="http://docs.amazonwebservices.com/AmazonS3/latest/dev/index.html?RESTAuthentication.html" rel="noreferrer">Amazon AWS</a></strong></p>
  
  <p>PS: thats no mistake, Google Checkout supports both</p>
  
  <p><strong>Edit:</strong> Just read that OAuth 2 is dropping signatures in favour of sending a username/password via SSL.</p>
  
  <p>Any opinions from anyone on what to pick: SSL vs Signature?</p>