I'm currently designing a API Model to use. A user will have a 'secret_api_key' and a 'public_api_key'. They will send a request to my server with the public key, the form data, and then a hash. The hash is the form data encrypted with the 'secret_api_key'.
This is so that the server will recreate this hash since it knows the 'secret_api_key' and if the hashes are the same then accept the request, else deny it.
I know with OAuth you get a 'access_token' which you just send with a request, surely someone could use a traffic sniffer and resend requests with the same access token? Or does OAuth working differently?
Any help or suggestions would be much appreciated.