I'm trying to integrate with my host using their REST webservices.

However, the authentication for the webservice only requires two things:

  • An API token which I can retreive from their portal once
  • My username to access their portal

Both need to be sent in the headers, under the names 'ApiKey' and 'PortalUsername'. It must be sent over HTTPS.

How safe is this really? I'm not too technical but I do know a few things about webservices and authentication. HTTPS is not the solution to protect against every kind of interception. I once integrated with some other webservice and they required the API key to be hashed and digested via some path, that seemed safer to me.

I'm eager to learn more on this subject and know wether I can safely use this webservice (with access to quite sensitive information), or not based on how they setup the authentication.

  • It's fine. Stop worrying and build your app :)
    – paj28
    Commented Aug 11, 2016 at 13:27
  • Thanks :) I'm just interested in learning more about this since I see so many different authentication methods for all webservices available and I don't know what's safe / outdated and what not.
    – Marcel
    Commented Aug 11, 2016 at 13:51

1 Answer 1


Everything that goes through HTTPS is enough as long they use a certificate trusted by your browser. This means it was forged by 3rd-party acknowledged authority of certification.

If they use their own certificate. You may reconsider that statement.

  • Thanks! They use Comodo certificate, which is trusted by the browser. No self-signed certificate if that's what you mean.
    – Marcel
    Commented Aug 11, 2016 at 13:52
  • @user2897757 Yes it is, if you use their rest services with other non web-application languages too (c#/Java) don't forget to do the proper set-up in order to allow only their certificate and not a self-signed.
    – Walfrat
    Commented Aug 11, 2016 at 13:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .