I'm creating a web api that queues messages and routes webhooks to individual sites. The transactional email service MailGun provides an api key to all users, which is used as the HTTP basic auth password. All accounts use api
as the HTTP basic auth username. This results in api:SPECIFIC_API_TOKEN
for all accounts.
Is this an acceptable practice, and is there a specific situation where the service I'm building could or shouldn't use this method of authentication?