We are developing a password vault solution which gives a web service based API for fetching password from our vault. The API consumers will authenticate by supplying valid credentials and will request for username and password for an IPAddress. How can we ensure that our API consumers have not stored or relayed the password further ? Is there a way to copy-protect passwords ?
We are using WCF over https for exposing our web service APIs.