I'm creating a web api that queues messages and routes webhooks to individual sites. The transactional email service MailGun provides an api key to all users, which is used as the HTTP basic auth password. All accounts use
api as the HTTP basic auth username. This results in
api:SPECIFIC_API_TOKEN for all accounts.
Is this an acceptable practice, and is there a specific situation where the service I'm building could or shouldn't use this method of authentication?