I'm trying to integrate with my host using their REST webservices.
However, the authentication for the webservice only requires two things:
- An API token which I can retreive from their portal once
- My username to access their portal
Both need to be sent in the headers, under the names 'ApiKey' and 'PortalUsername'. It must be sent over HTTPS.
How safe is this really? I'm not too technical but I do know a few things about webservices and authentication. HTTPS is not the solution to protect against every kind of interception. I once integrated with some other webservice and they required the API key to be hashed and digested via some path, that seemed safer to me.
I'm eager to learn more on this subject and know wether I can safely use this webservice (with access to quite sensitive information), or not based on how they setup the authentication.