title: Can SSL and a key code alone be enough to keep a Web API secure?
body: <p>I have an ASP.Net Web API (v2) that will require SSL for all calls made to it, no exceptions. There is no login for the system, instead I plan on providing a user with a <s>secret key</s> key code that will identify them. All future based requests would include this <s>secret key</s> key code as a way to identify and authenticate who that user is.</p>
  
  <p>My question is whether SSL is sufficient enough to keep this secure? Assuming that there is never an insecure connection that contains the secret key do I need to go through other lengths to encrypt or protect it? I've read up on symmetric, asymetric, and hashing methods, but it seems like this may only be redundant if SSL is in place throughout.</p>
  
  <p>This seems too simple, what am I missing?</p>
  
  <p>Some other notes, the <s>secret key</s> key code is not hand entered by the user. It is either stored in a system application (encrypted) or used by another company's API contacting ours.</p>