Instead of passing an authentication token or api key in an http header to a server in the plain text, what if I calculated its hash and passed the hash? This way even if a adversary intercepts the hash, it'll be useless for them. And a server can easily calculate a hash of the real password on its side as well and then check if they match. A salt can be added also.
Will it work? Is this approach widely used?