I've created a small wishlist project.

I wan't to serve an API for users, which have an API Key.

My webserver run on TLS (HTTPS). It is safe for users to send api key in clear in the http headers like that ?

curl -H "Authorization: api_key MY_APP_API_KEY" https://myapp.example.com

Otherwise, what should I use ?

I would like not to use OAuth2, which is too complex for my little project.

CodePudding user response：

Yes it is perfectly safe.. HTTPS encrypts all message contents, including the HTTP headers and the request/response data.